chore(deps): migrate to @inquirer/prompts v8 + @inquirer/core v11

[ryandemelo]

Closes #1458.

Why the two Dependabot bumps couldn't work

#1450 (prompts 7→8) and #1422 (core 10→11) were opened as separate PRs and both closed unmerged. They can't land independently:

• @inquirer/prompts@8 → @inquirer/checkbox@5.2.1 → @inquirer/core@^11
• package.json also depends on @inquirer/core@^10 directly, because two files build custom prompts on its hooks API

Moving one side alone leaves two copies of @inquirer/core in the tree — the custom prompts running v10 internals next to bundled prompts on v11. That's a latent runtime hazard a green typecheck wouldn't catch. This PR moves both together.

Verified after a clean rm -rf node_modules && pnpm install:

$ find node_modules/.pnpm -maxdepth 1 -name "@inquirer+core@*"
  @inquirer+core@11.2.1_@types+node@20.19.43     # single copy

The instructions removal

checkbox v5 removed the instructions option (the TS2353 in src/commands/config.ts). The issue flagged this as a UX call — drop the hint or re-express it via the theme.

Dropped it, because v5's built-in keys help tip already renders a superset of what was being passed. Old hand-written hint vs. what ships now:

	rendered
before	Space to toggle, Enter to confirm
after (built-in)	↑↓ navigate • space select • a all • i invert • ⏎ submit

Confirmed by running openspec config profile — the custom [x]/[ ] theme icons are preserved and the help line is strictly more informative, so a theme.style.keysHelpTip override would only make it worse.

Custom prompts on the core hooks API

The issue called out usePrefix({ status }) as worth double-checking, and warned that a green typecheck isn't sufficient here. Checked both ways.

Static: every hook used by src/prompts/searchable-multi-select.ts and src/ui/welcome-screen.ts is unchanged in v11 — usePrefix({ status, theme }) keeps its signature, and use-memo / use-keypress / use-prefix are byte-identical to v10. use-state differs only by an internal type guard. key.js is byte-identical apart from v11 adding getDefaultKeybindings/isShiftKey; isUpKey/isDownKey still default keybindings to [], so the no-arg calls in searchable-multi-select keep exactly their v10 behavior (this matters — a vim default would have made typing k/j navigate instead of filter).

Runtime: drove both custom prompts under a real PTY against core v11.

searchable-multi-select (choices: alpha, beta [pre-selected], gamma, delta):

input	result	exercises
type g → space → ⏎	["b","g"]	type-to-filter (not vim-nav), useState/useMemo, space toggle
↓ → space → ⏎	[]	isUpKey/isDownKey, toggle-off
backspace → ⏎	[]	isBackspaceKey remove-last-selected

welcome-screen (createPrompt + useKeypress + isEnterKey): returns only after Enter in both static and animated modes — elapsed 1157ms / 1429ms against keystrokes sent at ~1.2s/1.5s, confirming it actually blocked rather than falling through.

Worth noting for the Windows caveat documented in welcome-screen.ts: core v11's create-prompt now explicitly mutes output after readline initializes, so readline can perform terminal setup writes (e.g. Windows Console API initialization) first. That moves in the right direction for the arrow/space-key issue that comment describes, though I have no Windows machine to confirm on.

Test plan

• pnpm build — clean
• pnpm lint — clean
• pnpm test — 136/136 files, 3969/3969 tests pass
• Clean node_modules reinstall → exactly one @inquirer/core
• PTY runtime checks of both custom prompts (table above)
• openspec config profile renders the checkbox with icons + new help tip

No changeset — per .changeset/README.md the normal release cadence is the default. Happy to add one if you'd like this tracked for dedicated release notes, since the checkbox help line is user-visible.

Summary by CodeRabbit

• Enhancements
  • Updated interactive prompts to use the latest prompt behavior.
  • Workflow-selection screens now display built-in keyboard guidance automatically.
• Maintenance
  • Updated prompt-related components to newer versions for improved compatibility and usability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 628fc47e-22d2-4a80-8a1a-00f83cd9cc5d

📥 Commits

Reviewing files that changed from the base of the PR and between 2826b88 and ab39042.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• package.json
• src/commands/config.ts

---

📝 Walkthrough

Walkthrough

The change upgrades @inquirer/core and @inquirer/prompts, and removes the obsolete checkbox instructions option from workflow selection.

Changes

Inquirer migration

Layer / File(s)	Summary
Dependency and checkbox API update package.json, src/commands/config.ts	The Inquirer dependency ranges are upgraded. The workflow-selection checkbox no longer sets instructions and documents reliance on the built-in help tip.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to ab390

This change updates the Inquirer dependencies together and removes an obsolete checkbox option while preserving the custom prompt behavior and improving the built-in help text; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: clay-good, tabishb

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR upgrades both Inquirer packages and removes checkbox instructions, but shows no flake.nix hash update or Dependabot ignore reversal required by #1458.	Update flake.nix pnpmDeps for the new lockfile and revert the Dependabot ignore before merging.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the coordinated migration to @inquirer/prompts v8 and @inquirer/core v11.
Out of Scope Changes check	✅ Passed	The package upgrades and checkbox change directly implement issue #1458, with no unrelated code changes shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}