feat(cli): Add PR/issue attachments with stable URLs to the uploads CLI

[Zach Dunn (zachdunn)]

Adds GitHub PR/issue attachments to the @buildinternet/uploads CLI. No API changes — the server already supports everything via ?prefix= listing.

What's new

• uploads put <file> --pr <num> / --issue <num> — uploads to a deterministic key: gh/<owner>/<repo>/pull/<num>/<filename> (no content hash, unlike the screenshot key scheme). Same filename → same key → same URL, so re-uploading a file updates every place the URL is already embedded on GitHub. Repo is inferred from the git remote (gh repo view, falling back to parsing origin); --repo owner/name overrides.
• uploads comment --pr <num> (and put … --comment) — creates or updates a single managed "📎 Attachments" comment on the PR/issue through the user's local gh auth. It finds its own prior comment via a hidden marker (<!-- uploads.sh:attachments -->) and edits it in place; it never touches other comments or the description. On put --comment, gh failures degrade to a warning — the upload never fails because GitHub is unreachable.
• uploads list --pr <num> / --issue <num> — prefix-translated listing of a PR/issue's attachments.
• Test harness: vitest added to the package (first tests in the repo, 33 passing). Subprocess calls go through an injectable CommandRunner (always execFileSync with arg arrays; comment bodies via stdin), so the gh interaction is unit-tested without network.

Design docs

• Spec: docs/superpowers/specs/2026-07-07-github-companion-design.md (includes compatibility notes with the parallel shared-bucket workspace-prefix work — the two compose without changes to either)
• Plan: docs/superpowers/plans/2026-07-07-github-companion-v1.md

Verification

Live end-to-end against production (workspace default, scratch PR #7, since closed): upload → embed → re-upload same filename → URL served the new bytes; comment run twice produced exactly one managed comment (created, then edited in place); with gh hidden from PATH, the upload succeeded with a warning and exit 0. Evidence in the task reports under .superpowers/sdd/ (not committed).

Follow-ups (deferred)

• Multi-page cursor loop in the comment sync has no dedicated test (simple loop; exercised live)
• Managed-comment search covers the first 100 comments only (documented v1 limitation)
• A companion docs-only commit in buildinternet-skills (local b3a3b4a, not pushed) points the github-screenshots skill at this CLI

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 238104d3-ca17-4bdb-b859-92f05e8f5ecd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/github-uploads-brainstorm-1462e6

---

_{Comment @coderabbitai help to get the list of available commands.}