Attach a PDF, a dump or a markdown file, once GitHub's upload takes them.

A reviewer pointing at something visual has to describe it in words today. Pasting or dragging a screenshot into a comment box would say it directly, and would also let a session read the picture rather than the description of it.

Held until GitHub offers an upload, so that a comment says the same thing here and on the pull request. The web UI's drag-and-drop asks for an upload policy, PUTs the bytes to a signed target and inserts a github.com/user-attachments/assets/<uuid> link - all authenticated by a browser session. There is no REST or GraphQL endpoint behind it: the schema carries no mutation for attachments, gh has no command for it, and the requests are closed as blocked on the platform API (cli/cli#1895, cli/cli#4465, cli/cli#12960, cli/cli#13256, community#28219). Building only the local half would leave a comment whose screenshot exists on this desk and nowhere on the pull request, which is the one thing this tool is meant not to do.

The paths that exist meanwhile were considered and set aside: release assets on a fork and blobs committed to a branch both host the bytes with a token, but they put review screenshots in a repository's releases or history; the extensions that reproduce the web flow (gh-image, gh-attach) work by carrying a browser session, so the desk would depend on someone else's cookie handling for a core path.

What to build when the upload exists:

• The comment box takes an image from a paste and from a drop, since a screenshot arrives either way.
• The bytes are written beside the log, one file per image, and the comment row keeps the file name. Not the bytes: the page reads the whole log on every poll, so inlining them would make every read carry every screenshot.
• The thread renders the image at a bounded width, click to open it whole.
• desk.py comments prints the file path, so a session can open what the reviewer saw.
• A sync uploads what a comment carries and posts the body with the links in it, and a comment marked local keeps its screenshots local, exactly as its text already is.

Revisit when a documented upload endpoint appears, or when gh grows the command.

The issue is explicitly held until GitHub or gh provides a documented upload endpoint; current platform limitations and rejected alternatives are listed in the body. When unblocked, start with the comment box, thread rendering, desk.py comments, and sync paths. Done means pasted or dropped images are stored beside the log, shown in the thread, exposed by file path, and synchronized with comment links while local comments remain local.