feat: add post-install onboarding (skill install + test query)

[arein]

Summary

• Adds a postinstall hook that runs after npm install -g nansen-cli
• Interactively offers to install the Nansen AI coding skill (npx skills add nansen-ai/nansen-cli)
• Offers to run a test query (SOL token stats on Solana) to verify the setup works
• Non-interactive environments (CI, piped stdin) get a one-liner tip instead — never blocks

Details

• Only runs on global installs (npm_config_global === "true")
• Uses execFileSync / spawn without shell: true to avoid injection surfaces
• Uses process.execPath + relative CLI entry path so the test query works even before npm finishes bin linking
• npx -y avoids nested "install skills package?" prompt
• Always exits 0 — onboarding errors never break installation

Test plan

• npm install -g nansen-cli on a fresh machine shows the interactive onboarding
• Pressing Enter (default Y) installs the skill and runs the test query
• Pressing n skips each step with a manual-install tip
• npm ci in CI does not show any prompts or output
• Non-TTY install (echo "" | npm install -g nansen-cli) shows tips only

🤖 Generated with Claude Code

[nansen-pr-reviewer]

pr-reviewer Summary

📝 2 findings

Review completed. Please address the findings below.

Findings by Severity

Severity	Count
🟡 Medium	1
🔵 Low	1

Review effort: 3/5 (Moderate)

Summary

This PR does two things: (1) adds a post-install onboarding script that offers to install the Nansen AI coding skill and verify the API key after npm install -g, and (2) reverts the web search/web fetch commands that were introduced in a prior PR. The postinstall script is well-implemented — proper TTY detection, Windows compatibility via shell: process.platform === "win32", a double-resolve guard on prompt(), silent error handling so broken onboarding never fails installation, and a correct global-vs-local install guard. Two minor issues were found.

Findings

scripts/postinstall.js + package.json — Missing changeset (medium)

Severity: medium — CONTRIBUTING.md violation

CONTRIBUTING.md and the check-changeset.js pretest hook both require a changeset file for user-facing changes. This PR introduces a brand-new user-facing feature (the post-install onboarding flow) and removes the web command (a previously shipped feature). The PR deletes .changeset/add-web-search-web-fetch.md but adds no replacement changeset for either change.

The check-changeset.js script will emit a warning on test runs (exit 0), not a hard failure — but per CONTRIBUTING.md the changeset is expected. Without one, neither the postinstall feature nor the web removal will appear in CHANGELOG.md when the next release PR is cut.

Suggested fix: Add a changeset, e.g.:

npx changeset
# pick: patch (onboarding is non-breaking) or minor (new behavior)

---

.github/workflows/sync-clawhub.yml — Unexplained version downgrade (low)

Severity: low

clawhub is downgraded from 0.8.0 → 0.7.0 with no code comment or commit message explanation. If 0.8.0 broke something in CI this is the right fix, but future maintainers will have no context for why the older version is pinned.

Suggested fix: Add an inline comment to the workflow step, e.g.:

# Pinned to 0.7.0 — 0.8.0 introduced a breaking change in the sync command (see <issue/link>)
run: npx --yes clawhub@0.7.0 login ...

---

Token usage: 18 input, 8,443 output, 292,340 cache read, 37,912 cache write | Usage Guide

[arein]

Addressed all feedback:

• ✅ Test query → nansen account — costs 0 credits, just validates the API key (kome12)
• ✅ Skip message → nansen research smart-money netflow — better example command (kome12)
• ✅ Windows npx compat — added shell: true on win32 for both execFileSync and spawn (bot)
• ✅ Double-resolve in prompt() — added answered guard so close handler only resolves on EOF (bot)

All 1043 tests pass.