veriskit 0.4.1 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.5.1 — 2026-07-13
+
+### Changed
+- `--github` publish errors now include GitHub's own message (for example "Resource not accessible by integration" when the workflow token lacks `pull-requests: write` or `checks: write`), so a failed publish is diagnosable. The token still never appears in any error.
+- `homepage` now points to the VerisKit product page.
+
+## 0.5.0 — 2026-07-13
+
+### Added
+- Publish to GitHub. `veris verify --github` posts and updates one sticky PR comment with the verdict and report, and creates a Check Run (verified passes, failed fails, partial is neutral). Token read from `GITHUB_TOKEN`; publishing never changes the verdict or exit code. `veris badge` writes a shields.io endpoint JSON. GitHub API over built-in fetch, no new dependency.
+- Browser tests. A real Playwright runner, opt-in with `veris verify --browser` (or a `browser` entry in `.veris/config.json`). Detected Playwright now shows as an available capability.
+- `veris log` lists past runs from the stored evidence records, and `veris log --flaky` flags checks that both passed and failed across recent runs. Local per-machine history.
+
 ## 0.4.1 — 2026-07-10
 
 ### Added

package/README.md

@@ -237,6 +237,64 @@ VerisKit says what it cannot do as plainly as what it can:
 - **Scanner fallback on plain-JS or TS 7.x-native projects.** The accurate resolver needs the classic TypeScript compiler API. Without it you get the labeled, relative-imports-only graph described above, and no dependency is added to paper over the gap.
 - **No keyless or identity-bound signing.** Evidence can be signed with a local Ed25519 key (see Signing), but sigstore-style keyless signing that ties a signature to an identity is not built yet.
 
+## Publish to a pull request
+
+In CI, surface the verdict where reviewers look. Opt in with `--github`; VerisKit
+reads `GITHUB_TOKEN` from the environment and never stores it.
+
+```bash
+veris verify --github   # posts/updates a sticky PR comment + a Check Run
+```
+
+It edits one comment on re-runs (no spam) and creates a Check Run whose
+conclusion follows the verdict (verified passes, failed fails, partial is
+neutral). Publishing is a side channel: if there is no token or PR, VerisKit
+prints a notice and the exit code still reflects the verdict, and a GitHub API
+error is reported but never changes the result.
+
+The workflow needs permission to write them:
+
+```yaml
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+```
+
+For a README badge, write a shields.io endpoint file:
+
+```bash
+veris badge   # writes .veris/badge.json
+```
+
+```markdown
+![VerisKit](https://img.shields.io/endpoint?url=<raw-url-to>/.veris/badge.json)
+```
+
+## Browser tests
+
+VerisKit can run your Playwright suite as part of the verdict. It is opt-in, so
+a normal `veris verify` stays fast:
+
+```bash
+veris verify --browser   # also runs `playwright test`, folded into the verdict
+```
+
+When Playwright is detected, `veris doctor` lists `browser` as available. You can
+also add `browser` to the `checks` array in `.veris/config.json` to run it every
+time.
+
+## History
+
+Every run leaves an evidence record, so VerisKit can show you a trend:
+
+```bash
+veris log            # past runs, newest first
+veris log --flaky    # checks that both passed and failed across recent runs
+```
+
+History is local to your machine (the `.veris/runs` directory is gitignored).
+
 ## Part of Baseframe Labs
 
 VerisKit is one of four developer tools from [Baseframe Labs](https://www.baseframelabs.com), each answering a different question about your work:

package/dist/index.js

@@ -105,13 +105,9 @@ function detectLint(root, has) {
   return { id: "lint", available: false, reason: "no linter configured" };
 }
 function detectBrowser(root, has) {
-  if (has("@playwright/test") || existsSync2(join(root, "playwright.config.ts")))
-    return {
-      id: "browser",
-      available: false,
-      runner: "playwright",
-      reason: "detected; browser execution deferred to v0.5"
-    };
+  if (has("@playwright/test") || existsSync2(join(root, "playwright.config.ts")) || existsSync2(join(root, "playwright.config.js"))) {
+    return { id: "browser", available: true, runner: "playwright" };
+  }
   return {
     id: "browser",
     available: false,
@@ -548,6 +544,76 @@ var init_node_test = __esm({
   }
 });
 
+// src/runners/playwright.ts
+function parsePlaywrightStats(stdout) {
+  try {
+    const json = JSON.parse(stdout);
+    return json.stats ?? null;
+  } catch {
+    return null;
+  }
+}
+var TAIL_LINES2, playwrightRunner;
+var init_playwright = __esm({
+  "src/runners/playwright.ts"() {
+    "use strict";
+    init_store();
+    init_exec();
+    init_base();
+    TAIL_LINES2 = 20;
+    playwrightRunner = {
+      id: "playwright",
+      toCheck(project, _cap) {
+        return {
+          id: "browser",
+          title: "Browser tests",
+          runner: "playwright",
+          cmd: localBin(project.root, "playwright"),
+          args: ["test", "--reporter=json"]
+        };
+      },
+      async run(check, ctx) {
+        const r = await exec(check.cmd, check.args, {
+          cwd: ctx.root,
+          timeoutMs: 15 * 6e4
+        });
+        const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
+        const logRef = await writeLog(ctx.runDir, check.id, `${output}
+`);
+        const stats = parsePlaywrightStats(r.stdout);
+        let status;
+        if (r.timedOut) {
+          status = "unknown";
+        } else if (stats) {
+          status = r.code === 0 && (stats.unexpected ?? 0) === 0 ? "passed" : "failed";
+        } else {
+          status = r.code === 0 ? "unknown" : "failed";
+        }
+        const result = {
+          checkId: "browser",
+          status,
+          durationMs: r.durationMs,
+          summary: status === "passed" ? "browser tests passed" : r.timedOut ? "timed out" : status === "unknown" ? "browser tests ran but the results could not be parsed" : "browser tests failed",
+          logRef
+        };
+        if (stats) {
+          const passed = stats.expected ?? 0;
+          const failed = stats.unexpected ?? 0;
+          result.counts = {
+            passed,
+            failed,
+            total: passed + failed + (stats.flaky ?? 0) + (stats.skipped ?? 0)
+          };
+        }
+        if (status !== "passed" && output) {
+          result.outputTail = output.split("\n").slice(-TAIL_LINES2).join("\n");
+        }
+        return result;
+      }
+    };
+  }
+});
+
 // src/runners/tsc.ts
 var tscRunner;
 var init_tsc = __esm({
@@ -614,6 +680,7 @@ var init_runners = __esm({
     init_eslint();
     init_jest();
     init_node_test();
+    init_playwright();
     init_tsc();
     init_vitest();
     init_base();
@@ -623,7 +690,8 @@ var init_runners = __esm({
       jest: jestRunner,
       "node-test": nodeTestRunner,
       eslint: eslintRunner,
-      biome: biomeRunner
+      biome: biomeRunner,
+      playwright: playwrightRunner
     };
   }
 });
@@ -997,15 +1065,211 @@ var init_markdown = __esm({
   }
 });
 
+// src/publish/comment.ts
+function renderComment(run, record) {
+  const summary = run.results.filter((r) => r.status !== "skipped").map((r) => `${r.checkId} ${r.status}`).join(" \xB7 ");
+  return [
+    MARKER,
+    `**VerisKit: ${STATE_LABEL2[run.verdict.state]}**`,
+    "",
+    summary,
+    "",
+    "<details><summary>Report</summary>",
+    "",
+    renderMarkdown(run, record),
+    "",
+    "</details>",
+    ""
+  ].join("\n");
+}
+var MARKER, STATE_LABEL2;
+var init_comment = __esm({
+  "src/publish/comment.ts"() {
+    "use strict";
+    init_markdown();
+    MARKER = "<!-- veriskit-report -->";
+    STATE_LABEL2 = {
+      verified: "verified",
+      failed: "failed",
+      partial: "partial"
+    };
+  }
+});
+
+// src/publish/context.ts
+import { readFileSync as readFileSync2 } from "fs";
+function defaultReadEvent(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function resolvePublishContext(env = process.env, readEvent = defaultReadEvent) {
+  const repository = env.GITHUB_REPOSITORY;
+  const token = env.GITHUB_TOKEN;
+  if (!repository || !token) return null;
+  const [owner, repo] = repository.split("/");
+  if (!owner || !repo) return null;
+  let prNumber = null;
+  let headSha = env.GITHUB_SHA ?? "";
+  const refMatch = (env.GITHUB_REF ?? "").match(/^refs\/pull\/(\d+)\//);
+  if (refMatch) prNumber = Number(refMatch[1]);
+  const event = readEvent(env.GITHUB_EVENT_PATH ?? "");
+  const pr = event?.pull_request;
+  if (pr) {
+    if (prNumber === null && typeof pr.number === "number") {
+      prNumber = pr.number;
+    }
+    if (pr.head?.sha) headSha = pr.head.sha;
+  }
+  if (prNumber === null || !headSha) return null;
+  return { owner, repo, token, prNumber, headSha };
+}
+var init_context = __esm({
+  "src/publish/context.ts"() {
+    "use strict";
+  }
+});
+
+// src/publish/github.ts
+function headers(token) {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "veriskit",
+    "Content-Type": "application/json"
+  };
+}
+async function gh(method, url, token, body) {
+  const res = await fetch(url, {
+    method,
+    headers: headers(token),
+    body: body === void 0 ? void 0 : JSON.stringify(body)
+  });
+  if (!res.ok) {
+    const path = url.replace("https://api.github.com", "");
+    let detail = "";
+    try {
+      const errBody = await res.json();
+      if (errBody?.message) detail = `: ${errBody.message}`;
+    } catch {
+    }
+    throw new GitHubApiError(
+      res.status,
+      `GitHub API ${method} ${path} -> ${res.status}${detail}`
+    );
+  }
+  return res.status === 204 ? null : res.json();
+}
+function repoBase(ctx) {
+  return `https://api.github.com/repos/${ctx.owner}/${ctx.repo}`;
+}
+async function upsertComment(ctx, body) {
+  const base = repoBase(ctx);
+  const comments = await gh(
+    "GET",
+    `${base}/issues/${ctx.prNumber}/comments?per_page=100`,
+    ctx.token
+  );
+  const existing = comments.find((c) => (c.body ?? "").includes(MARKER));
+  if (existing) {
+    await gh("PATCH", `${base}/issues/comments/${existing.id}`, ctx.token, {
+      body
+    });
+  } else {
+    await gh("POST", `${base}/issues/${ctx.prNumber}/comments`, ctx.token, {
+      body
+    });
+  }
+}
+async function createCheckRun(ctx, opts) {
+  await gh("POST", `${repoBase(ctx)}/check-runs`, ctx.token, {
+    name: opts.name,
+    head_sha: ctx.headSha,
+    status: "completed",
+    conclusion: opts.conclusion,
+    output: { title: opts.title, summary: opts.summary }
+  });
+}
+var GitHubApiError;
+var init_github = __esm({
+  "src/publish/github.ts"() {
+    "use strict";
+    init_comment();
+    GitHubApiError = class extends Error {
+      status;
+      constructor(status, message) {
+        super(message);
+        this.name = "GitHubApiError";
+        this.status = status;
+      }
+    };
+  }
+});
+
+// src/publish/publish.ts
+async function publishToGitHub(run, record) {
+  const ctx = resolvePublishContext();
+  if (!ctx) {
+    process.stdout.write(
+      "veris: --github set but no GitHub PR context found (need GITHUB_TOKEN + a pull_request event); skipping publish.\n"
+    );
+    return;
+  }
+  try {
+    await upsertComment(ctx, renderComment(run, record));
+    await createCheckRun(ctx, {
+      name: "VerisKit",
+      conclusion: CONCLUSION[run.verdict.state],
+      title: `VerisKit: ${run.verdict.state}`,
+      summary: renderMarkdown(run, record)
+    });
+    process.stdout.write(
+      `veris: published the verdict to PR #${ctx.prNumber}
+`
+    );
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: GitHub publish failed: ${msg}
+`);
+  }
+}
+var CONCLUSION;
+var init_publish = __esm({
+  "src/publish/publish.ts"() {
+    "use strict";
+    init_markdown();
+    init_comment();
+    init_context();
+    init_github();
+    CONCLUSION = {
+      verified: "success",
+      failed: "failure",
+      partial: "neutral"
+    };
+  }
+});
+
 // src/cli/commands/verify.ts
 var verify_exports = {};
 __export(verify_exports, {
+  resolveChecks: () => resolveChecks,
   runVerify: () => runVerify
 });
+function resolveChecks(configChecks, project, opts) {
+  let checks = configChecks?.length ? configChecks : DEFAULT_CHECKS;
+  if (opts.browser && !checks.includes("browser")) {
+    const cap = project.capabilities.find((c) => c.id === "browser");
+    if (cap?.available) checks = [...checks, "browser"];
+  }
+  return checks;
+}
 async function runVerify(root, opts = {}) {
   const project = await detectProject(root);
   const config = await loadConfig(root);
-  const checks = config?.checks?.length ? config.checks : DEFAULT_CHECKS;
+  const checks = resolveChecks(config?.checks, project, opts);
   const run = await runChecks(project, checks, root);
   const git = await gitAnchor(root);
   const logDigests = await digestLogs(run);
@@ -1020,6 +1284,7 @@ async function runVerify(root, opts = {}) {
   await writeEvidence(runDir, record);
   process.stdout.write(`${renderRun(run, record)}
 `);
+  if (opts.github) await publishToGitHub(run, record);
   return verdictExitCode(run.verdict, opts);
 }
 var DEFAULT_CHECKS;
@@ -1033,6 +1298,7 @@ var init_verify = __esm({
     init_record();
     init_store();
     init_changes();
+    init_publish();
     init_markdown();
     init_terminal();
     init_version();
@@ -1045,7 +1311,7 @@ var report_exports = {};
 __export(report_exports, {
   runReport: () => runReport
 });
-import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
 import { join as join6 } from "path";
 async function runReport(root) {
   const dir = join6(root, ".veris", "reports");
@@ -1061,7 +1327,7 @@ async function runReport(root) {
     process.stdout.write("No reports yet. Run `veris verify` first.\n");
     return 0;
   }
-  process.stdout.write(`${readFileSync2(join6(dir, latest), "utf8")}
+  process.stdout.write(`${readFileSync3(join6(dir, latest), "utf8")}
 `);
   return 0;
 }
@@ -1176,7 +1442,7 @@ var init_discover = __esm({
 });
 
 // src/project-graph/scanner-resolver.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
 import { dirname, join as join8, relative as relative3, resolve } from "path";
 function extractSpecifiers(text) {
   const specs = [];
@@ -1215,7 +1481,7 @@ function resolveRelative(fromDir, spec) {
 function scannerImports(root, file) {
   let text;
   try {
-    text = readFileSync3(join8(root, file), "utf8");
+    text = readFileSync4(join8(root, file), "utf8");
   } catch {
     return [];
   }
@@ -1239,7 +1505,7 @@ var init_scanner_resolver = __esm({
 });
 
 // src/project-graph/ts-resolver.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
 import { createRequire } from "module";
 import { join as join9, relative as relative4, sep as sep2 } from "path";
 function hasClassicApi(mod) {
@@ -1266,7 +1532,7 @@ function loadCompilerOptions(tsmod, root) {
 function tsImports(tsmod, root, options, file) {
   let text;
   try {
-    text = readFileSync4(join9(root, file), "utf8");
+    text = readFileSync5(join9(root, file), "utf8");
   } catch {
     return [];
   }
@@ -1518,6 +1784,7 @@ async function runAffected(root, opts = {}) {
 `);
   if (narrowedNote) process.stdout.write(`${narrowedNote}
 `);
+  if (opts.github) await publishToGitHub(run, record);
   return verdictExitCode(run.verdict, opts);
 }
 var init_affected = __esm({
@@ -1530,6 +1797,7 @@ var init_affected = __esm({
     init_record();
     init_store();
     init_changes();
+    init_publish();
     init_markdown();
     init_terminal();
     init_version();
@@ -2143,7 +2411,7 @@ __export(evidence_exports, {
   runEvidenceSign: () => runEvidenceSign,
   runEvidenceVerify: () => runEvidenceVerify
 });
-import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync } from "fs";
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync } from "fs";
 import { writeFile as writeFile4 } from "fs/promises";
 import { basename as basename3, dirname as dirname2, join as join12 } from "path";
 import pc5 from "picocolors";
@@ -2151,7 +2419,7 @@ async function runEvidenceVerify(path, opts = {}) {
   let expectedPubKeyPem;
   if (opts.pubkey) {
     try {
-      expectedPubKeyPem = readFileSync5(opts.pubkey, "utf8");
+      expectedPubKeyPem = readFileSync6(opts.pubkey, "utf8");
     } catch {
       process.stderr.write(`veris: cannot read public key at ${opts.pubkey}
 `);
@@ -2206,8 +2474,8 @@ async function runEvidenceKeygen(root, opts = {}) {
     );
     return 1;
   }
-  const { mkdir: mkdir2 } = await import("fs/promises");
-  await mkdir2(dirname2(out), { recursive: true });
+  const { mkdir: mkdir3 } = await import("fs/promises");
+  await mkdir3(dirname2(out), { recursive: true });
   const kp = generateKeyPair();
   writeFileSync(out, kp.privateKeyPem, { mode: 384 });
   chmodSync(out, 384);
@@ -2228,7 +2496,7 @@ async function runEvidenceSign(evidencePath, opts = {}) {
     privateKeyPem = process.env.VERISKIT_SIGNING_KEY;
   } else if (opts.key) {
     try {
-      privateKeyPem = readFileSync5(opts.key, "utf8");
+      privateKeyPem = readFileSync6(opts.key, "utf8");
     } catch {
       process.stderr.write(`veris: cannot read signing key at ${opts.key}
 `);
@@ -2242,7 +2510,7 @@ async function runEvidenceSign(evidencePath, opts = {}) {
   }
   let record;
   try {
-    record = JSON.parse(readFileSync5(evidencePath, "utf8"));
+    record = JSON.parse(readFileSync6(evidencePath, "utf8"));
   } catch {
     process.stderr.write(`veris: cannot read evidence at ${evidencePath}
 `);
@@ -2285,7 +2553,7 @@ async function runEvidenceBundle(root, opts = {}) {
   let record;
   try {
     record = JSON.parse(
-      readFileSync5(join12(runDir, "evidence.json"), "utf8")
+      readFileSync6(join12(runDir, "evidence.json"), "utf8")
     );
   } catch {
     process.stderr.write(`veris: no evidence.json in ${runDir}
@@ -2294,7 +2562,7 @@ async function runEvidenceBundle(root, opts = {}) {
   }
   let report = "";
   try {
-    report = readFileSync5(
+    report = readFileSync6(
       join12(root, ".veris", "reports", `verify-${record.id}.md`),
       "utf8"
     );
@@ -2306,7 +2574,7 @@ async function runEvidenceBundle(root, opts = {}) {
   const sigPath = join12(runDir, "evidence.json.sig");
   if (existsSync6(sigPath)) {
     try {
-      signature = JSON.parse(readFileSync5(sigPath, "utf8"));
+      signature = JSON.parse(readFileSync6(sigPath, "utf8"));
     } catch {
     }
   }
@@ -2330,7 +2598,7 @@ async function runEvidenceShow(root, path) {
   }
   let record;
   try {
-    record = JSON.parse(readFileSync5(target, "utf8"));
+    record = JSON.parse(readFileSync6(target, "utf8"));
   } catch {
     process.stderr.write(`veris: cannot read evidence at ${target}
 `);
@@ -2365,6 +2633,181 @@ var init_evidence = __esm({
   }
 });
 
+// src/publish/badge.ts
+function buildBadge(verdict) {
+  const s = STYLE[verdict.state];
+  return {
+    schemaVersion: 1,
+    label: "veriskit",
+    message: s.message,
+    color: s.color
+  };
+}
+var STYLE;
+var init_badge = __esm({
+  "src/publish/badge.ts"() {
+    "use strict";
+    STYLE = {
+      verified: { message: "verified", color: "14b8a6" },
+      failed: { message: "failed", color: "e5484d" },
+      partial: { message: "partial", color: "f5a623" }
+    };
+  }
+});
+
+// src/cli/commands/badge.ts
+var badge_exports = {};
+__export(badge_exports, {
+  runBadge: () => runBadge
+});
+import { readFileSync as readFileSync7 } from "fs";
+import { mkdir as mkdir2, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname3, join as join13 } from "path";
+async function runBadge(root, opts = {}) {
+  const dir = latestRunDir(root);
+  if (!dir) {
+    process.stdout.write("No runs yet. Run `veris verify` first.\n");
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(
+      readFileSync7(join13(dir, "evidence.json"), "utf8")
+    );
+  } catch {
+    process.stderr.write(`veris: no evidence.json in ${dir}
+`);
+    return 1;
+  }
+  const out = opts.out ?? join13(root, ".veris", "badge.json");
+  await mkdir2(dirname3(out), { recursive: true });
+  await writeFile5(
+    out,
+    `${JSON.stringify(buildBadge(record.verdict), null, 2)}
+`,
+    "utf8"
+  );
+  process.stdout.write(`Wrote badge ${out}
+`);
+  return 0;
+}
+var init_badge2 = __esm({
+  "src/cli/commands/badge.ts"() {
+    "use strict";
+    init_store();
+    init_badge();
+  }
+});
+
+// src/history/flaky.ts
+function detectFlaky(records) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const rec of records) {
+    for (const c of rec.checks ?? []) {
+      const arr = byId.get(c.id) ?? [];
+      arr.push(c.status);
+      byId.set(c.id, arr);
+    }
+  }
+  const flaky = [];
+  for (const [id, statuses] of byId) {
+    if (statuses.includes("passed") && statuses.includes("failed")) {
+      flaky.push({ id, statuses });
+    }
+  }
+  return flaky;
+}
+var init_flaky = __esm({
+  "src/history/flaky.ts"() {
+    "use strict";
+  }
+});
+
+// src/history/read.ts
+import { readdirSync as readdirSync5, readFileSync as readFileSync8 } from "fs";
+import { join as join14 } from "path";
+function loadRuns(root, limit = 20) {
+  const runs = join14(root, ".veris", "runs");
+  let names;
+  try {
+    names = readdirSync5(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name);
+  } catch {
+    return [];
+  }
+  const records = [];
+  for (const name of names) {
+    try {
+      const rec = JSON.parse(
+        readFileSync8(join14(runs, name, "evidence.json"), "utf8")
+      );
+      if (rec?.schema === "veriskit/evidence@1") records.push(rec);
+    } catch {
+    }
+  }
+  records.sort(
+    (a, b) => a.startedAt < b.startedAt ? 1 : a.startedAt > b.startedAt ? -1 : 0
+  );
+  return records.slice(0, limit);
+}
+var init_read = __esm({
+  "src/history/read.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/commands/log.ts
+var log_exports = {};
+__export(log_exports, {
+  runLog: () => runLog
+});
+async function runLog(root, opts = {}) {
+  const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? opts.limit : 20;
+  const records = loadRuns(root, limit);
+  if (records.length === 0) {
+    process.stdout.write("No runs yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  if (opts.flaky) {
+    const flaky = detectFlaky(records);
+    if (flaky.length === 0) {
+      process.stdout.write(
+        `No flaky checks in the last ${records.length} run(s).
+`
+      );
+      return 0;
+    }
+    process.stdout.write(
+      `Flaky checks (both passed and failed in the last ${records.length} run(s), newest first):
+`
+    );
+    for (const f of flaky) {
+      process.stdout.write(`  ${f.id.padEnd(8)} ${f.statuses.join(" ")}
+`);
+    }
+    return 0;
+  }
+  for (const rec of records) {
+    const date = rec.startedAt.slice(0, 19).replace("T", " ");
+    const checks = (rec.checks ?? []).map((c) => `${c.id}:${c.status}`).join(" ");
+    const commit = rec.git ? rec.git.commit.slice(0, 7) : "-";
+    process.stdout.write(
+      `${date}  ${rec.verdict.state.padEnd(9)} ${checks}  ${commit}
+`
+    );
+  }
+  process.stdout.write(
+    "\nHistory is local to this machine (.veris/runs is gitignored).\n"
+  );
+  return 0;
+}
+var init_log = __esm({
+  "src/cli/commands/log.ts"() {
+    "use strict";
+    init_flaky();
+    init_read();
+  }
+});
+
 // src/cli/index.ts
 init_version();
 import { realpathSync } from "fs";
@@ -2387,23 +2830,36 @@ function buildCli() {
     const { runInit: runInit2 } = await Promise.resolve().then(() => (init_init(), init_exports));
     process.exitCode = await runInit2(process.cwd());
   });
-  cli.command("verify", "Run the full check set and produce a verdict + report").option("--partial-ok", "Exit 0 even when the verdict is partial").action(async (opts) => {
-    const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
-    process.exitCode = await runVerify2(process.cwd(), {
-      partialOk: opts.partialOk
-    });
-  });
+  cli.command("verify", "Run the full check set and produce a verdict + report").option("--partial-ok", "Exit 0 even when the verdict is partial").option(
+    "--github",
+    "Publish the verdict to the GitHub PR (comment + check run)"
+  ).option("--browser", "Also run browser tests (Playwright), when available").action(
+    async (opts) => {
+      const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
+      process.exitCode = await runVerify2(process.cwd(), {
+        partialOk: opts.partialOk,
+        github: opts.github,
+        browser: opts.browser
+      });
+    }
+  );
   cli.command("report", "Print the latest verification report").action(async () => {
     const { runReport: runReport2 } = await Promise.resolve().then(() => (init_report(), report_exports));
     process.exitCode = await runReport2(process.cwd());
   });
-  cli.command("affected", "Run only the checks affected by changed files").option("--base <ref>", "Compare against a git ref instead of HEAD").option("--partial-ok", "Exit 0 even when the verdict is partial").action(async (opts) => {
-    const { runAffected: runAffected2 } = await Promise.resolve().then(() => (init_affected(), affected_exports));
-    process.exitCode = await runAffected2(process.cwd(), {
-      base: opts.base,
-      partialOk: opts.partialOk
-    });
-  });
+  cli.command("affected", "Run only the checks affected by changed files").option("--base <ref>", "Compare against a git ref instead of HEAD").option("--partial-ok", "Exit 0 even when the verdict is partial").option(
+    "--github",
+    "Publish the verdict to the GitHub PR (comment + check run)"
+  ).action(
+    async (opts) => {
+      const { runAffected: runAffected2 } = await Promise.resolve().then(() => (init_affected(), affected_exports));
+      process.exitCode = await runAffected2(process.cwd(), {
+        base: opts.base,
+        partialOk: opts.partialOk,
+        github: opts.github
+      });
+    }
+  );
   cli.command("watch", "Re-run affected checks as files change (Ctrl-C to stop)").option("--poll", "Use mtime polling instead of native fs.watch").action(async (opts) => {
     const { runWatch: runWatch2 } = await Promise.resolve().then(() => (init_watch(), watch_exports));
     process.exitCode = await runWatch2(process.cwd(), { poll: opts.poll });
@@ -2465,6 +2921,20 @@ function buildCli() {
       }
     }
   );
+  cli.command(
+    "badge",
+    "Write a shields.io endpoint JSON from the latest verdict"
+  ).option("--out <file>", "Output path (default .veris/badge.json)").action(async (opts) => {
+    const { runBadge: runBadge2 } = await Promise.resolve().then(() => (init_badge2(), badge_exports));
+    process.exitCode = await runBadge2(process.cwd(), { out: opts.out });
+  });
+  cli.command("log", "List past verification runs (local history)").option("--limit <n>", "How many runs to show (default 20)").option("--flaky", "Show only checks that flip-flop across runs").action(async (opts) => {
+    const { runLog: runLog2 } = await Promise.resolve().then(() => (init_log(), log_exports));
+    process.exitCode = await runLog2(process.cwd(), {
+      limit: opts.limit ? Number(opts.limit) : void 0,
+      flaky: opts.flaky
+    });
+  });
   return { raw: cli, version: VERSION };
 }
 async function main(argv2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veriskit",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "The fastest way to prove your software works — a zero-config verification CLI.",
   "scripts": {
     "test": "vitest run",
@@ -19,7 +19,7 @@
   "bugs": {
     "url": "https://github.com/abhiyoheswaran1/veris/issues"
   },
-  "homepage": "https://github.com/abhiyoheswaran1/veris#readme",
+  "homepage": "https://www.baseframelabs.com/apps/veriskit",
   "bin": {
     "veris": "bin/veris"
   },