npm package: @mergeproof/cli
Description: CLI for Mergeproof - Staked PR review protocol on GenLayer + Base
Latest version: 0.2.0

# @mergeproof/cli

CLI for [Mergeproof](https://mergeproof.vercel.app) — a staked PR review protocol on [GenLayer](https://genlayer.com) + Base.

Bounty creators fund issues, PR submitters stake tokens, bug hunters earn rewards, and attestors vouch for code quality. All on-chain.

## Install

```bash
npm install -g @mergeproof/cli
```

## Quick Start

```bash
# Set up your wallet
export MERGEPROOF_PRIVATE_KEY=0x...

# Optional: enable GitHub comments on issues/PRs
export GITHUB_TOKEN=ghp_...

# Create a bounty on a GitHub issue
mergeproof bounty create --repo owner/repo --issue 42 --amount 100

# Submit a PR against the bounty
mergeproof pr submit --bounty <id> --pr 43 --commit abc123

# Report a bug in the submission
mergeproof bug report --bounty <id> --commit abc123 \
  --severity major --description "SQL injection in login handler"

# Attest that the code is bug-free
mergeproof attest submit --bounty <id>

# Claim the bounty after the review window closes
mergeproof pr claim --bounty <id>
```

## Commands

### Bounties

| Command | Description |
|---------|-------------|
| `bounty create` | Create a bounty for a GitHub issue (deposits funds to escrow) |
| `bounty list` | List bounties (filter by `--status open\|in_review\|completed`) |
| `bounty info <id>` | Get bounty details |

### PR Submissions

| Command | Description |
|---------|-------------|
| `pr submit` | Submit a PR against a bounty (stakes required amount) |
| `pr retry` | Retry with a new commit after fixing bugs |
| `pr claim` | Claim the bounty after review window closes |
| `pr abandon` | Abandon submission and forfeit stake |
| `pr status <id>` | Get submission status and time remaining |

### Bug Reports

| Command | Description |
|---------|-------------|
| `bug report` | Report a bug (stakes 0.25% of bounty) |
| `bug validate <id>` | Validate a bug report as `--valid` or `--invalid` (owner only) |
| `bug list <submission-id>` | List bug reports for a submission |

### Attestations

| Command | Description |
|---------|-------------|
| `attest submit` | Attest code is bug-free (stakes 1% of bounty, earns 0.5% reward) |
| `attest list <bounty-id>` | List attestations for a bounty |

### Other

| Command | Description |
|---------|-------------|
| `identity verify` | Link your GitHub identity to your wallet |
| `wallet balance` | Check token balances |

## Networks

| Network | Flag | GenLayer | EVM | Web |
|---------|------|----------|-----|-----|
| `production` | default | GenLayer mainnet | Base | mergeproof.vercel.app |
| `staging` | `--network staging` | GenLayer staging | Base Sepolia | mergeproof-staging.vercel.app |
| `local` | `--network local` | localhost:4000 | Anvil | localhost:3456 |

```bash
# Use staging
mergeproof --network staging bounty list

# Or via env var
export MERGEPROOF_NETWORK=staging
```

All contract addresses and RPC URLs are baked in per environment. Override any value with env vars if needed.

## Configuration

| Environment Variable | Required | Description |
|---------------------|----------|-------------|
| `MERGEPROOF_PRIVATE_KEY` | Yes | Wallet private key (hex) |
| `MERGEPROOF_NETWORK` | No | `production` (default), `staging`, or `local` |
| `MERGEPROOF_GENLAYER_RPC` | No | Override GenLayer RPC URL |
| `MERGEPROOF_BASE_RPC` | No | Override Base RPC URL |
| `MERGEPROOF_BOUNTY_REGISTRY` | No | Override BountyRegistry address |
| `MERGEPROOF_ESCROW_ADDRESS` | No | Override Escrow address |
| `MERGEPROOF_TOKEN_ADDRESS` | No | Override ERC20 token address |
| `GITHUB_TOKEN` | No | GitHub PAT for posting comments on issues/PRs |

## Global Options

```
--network <env>  Network: production (default), staging, local
--json           Output in JSON format (for scripting)
--version        Show version
--help           Show help
```

## How It Works

1. **Bounty creator** funds a GitHub issue with tokens deposited to an EVM escrow contract
2. **PR submitter** stakes tokens and submits a PR for review
3. During the review window:
   - **Bug hunters** stake small amounts to report bugs (rewarded if valid, slashed if invalid)
   - **Attestors** stake to vouch for code quality (rewarded if no bugs, slashed if bugs found)
4. After the window closes, the submitter claims the bounty — funds release cross-chain via the GenLayer-to-Base bridge

## Links

- [Website](https://mergeproof.vercel.app)
- [GitHub](https://github.com/genlayerlabs/mergeproof)
- [Spec](https://github.com/genlayerlabs/mergeproof/blob/main/docs/SPEC.md)