A command for testing a React Native GitHub pull request on an iOS simulator, Android emulator, or physical device. It installs the proposed change, runs the relevant device checks, and reports results with evidence.

Use it to test a pull request by URL, repository and number, or number alone, with an optional platform selection.

It provides a repeatable way to check mobile changes without changing the main checkout, and identifies missing device setup separately from test failures.

qa-pr — Command for Claude Code by Lykhoyda/rn-dev-agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/Lykhoyda/rn-dev-agent

Made for: Claude Code.

Or install rn-dev-agent, the plugin that ships this one along with the rest of its 28 skills, 17 commands, 6 agents, 6 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/lykhoyda/rn-dev-agent/qa-pr/github.svg)](https://agentmods.dev/commands/lykhoyda/rn-dev-agent/qa-pr)

Your own site

<a href="https://agentmods.dev/commands/lykhoyda/rn-dev-agent/qa-pr"><img src="https://agentmods.dev/badge/commands/lykhoyda/rn-dev-agent/qa-pr/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/commands/lykhoyda/rn-dev-agent/qa-pr"><img src="https://agentmods.dev/badge/commands/lykhoyda/rn-dev-agent/qa-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 40 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,548 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00040	$0.01548
Opus 5.5	$0.00016	$0.00619
Sonnet 5.5	$0.00008	$0.00310
Haiku 4.5	$0.00004	$0.00155

Measured 29d ago against content hash e0512750e117, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

qa-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/claude-plugin/commands/qa-pr.md · 105 lines

How it starts

The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QA this React Native pull request: $ARGUMENTS

Run the rn-pr-qa protocol INLINE (parent session)

Important (GH #31): Do NOT spawn the rn-pr-qa agent via the Task tool. MCP tools (rn_session, cdp_*, device_*) are not available in spawned subagents. Execute the protocol in this parent session.

Load rn-workflow, rn-testing, rn-device-control, and capturing-proof. Follow agents/rn-pr-qa.md in this session. Summary:

Parse $ARGUMENTS. Require a GitHub PR URL, owner/repo#n, or number. Optional --platform ios|android|device|all (default all). If the PR identity is missing, ask once and stop.
Fetch with gh pr view. Stop on auth or lookup failure.
Classify the changed files. Docs-only → SKIP device, report files. Plugin MCP/device changes → exercise the workspace test-app (or the declared candidate app), never Metro-bind the plugin checkout.
Pin the head in a disposable git worktree. Do not mutate the primary checkout.
Inventory with rn-workflow steps 0–2, then rn_session(action="status"). device_list diagnoses; it does not choose. Missing requested hardware is SKIP with the exact setup gap.
Per selected target: bind_device (exact id) → preview_integration → apply_integration confirmed=true → run the rewritten <pm> run ios|android from the app root → poll until metroBound and installBound → pin_dev_client → cdp_dev_settings disableDevMenu then hideDevMenu, again after every re-pin (never touch the sheet or the gear; a visible sheet or gear is FAIL) → then the feature proof (agents/rn-pr-qa.md Step 7), user path only: usable screen or FAIL with the refusal code → reuse a covering action that starts from the attached app (rehearse with proofReplay=true); if none does, record and save a new one and drop its generated launchApp → first cdp_run_action rehearsal of a reused action from its first route (walk there as a user if the attached screen is not that route, or FAIL at the step that cannot) → walk back to the first screen off camera as a user (visible controls, at most one device_back per screen; never cdp_navigate or a deep link) before a saved action's first rehearsal, any repeat rehearsal, and the take, no runtime reset and no relaunch (never cdp_reload / cdp_restart / launchApp on camera) → hash the action after the last passing rehearsal → device_record start before the on-camera cdp_run_action proof replay → stop and validate. Missing video on an app-facing target is FAIL.
Cleanup reverse-order: runner close → stop_metro → restore_integration → release. Remove only the worktree you added.
Report. The public GitHub comment is for a human reviewer of the feature that was built, not a plugin log. One verdict: FAIL if any tested platform failed, PASS only if every requested platform that ran passed, plus one plain sentence per platform not tested ("Android was not requested." / "Android was not available."). A docs-only or all-SKIP run posts the same human shape with Verdict: SKIP, no video and no SKIP table. Re-read the head with gh pr view "<pr-url>" --json headRefOid before posting and stop if it fails; the verdict binds to the tested SHA. Post with gh pr comment --body-file plus --attach for every screenshot and video (GitHub CLI attaching-files flow); attachments are not required when there is nothing to attach. When a screenshot was attached, rewrite screenshot markdown to <img src="…" alt="…" width="390"> via --edit-last. Once the public comment exists, if the PR has needs-qa, run gh pr edit "<pr-url>" --remove-label needs-qa. A missing label is not FAIL. A stale-head FAIL comment and a SKIP comment still count; a run that never posted leaves the label. In-session only, print the per-target verdict table and the comment URL. Never leave unhosted /tmp paths as the reviewer-visible proof. Public comments are public: never write hostname (including .local), machine UUID, home directory (/Users/…), or other absolute local paths — even in a code fence. Replace with [HOST], [MACHINE_ID], [HOME], [PATH], [UDID], [UUID]. Sanitize the pre-upload body before posting (exempt only Markdown --attach destinations). Then self-check the rewritten GitHub body. Follow agents/rn-pr-qa.md § Public identity.

Read the full file on GitHub · 105 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

29d ago Changed e0512750e117
1mo ago Changed · +29 lines f6dc70c4082c
1mo ago Changed · +1 lines 316551f719a8
1mo ago Changed · +5 lines bcb29e850c7f
1mo ago First seen · 70 lines · 40 tokens per session scan A 2c5eb5c86133

Subscribe to this mod's changes

qa-pr is a command published in the GitHub repository Lykhoyda/rn-dev-agent (20 stars, last pushed 2d ago), licensed MIT. It adds 40 tokens to every session and 1,548 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-12.

E2E testing Mobile Testing agent agent-framework agent-orchestration agentic-ai agentic-workflow agents

qa-pr

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

Run the rn-pr-qa protocol INLINE (parent session)

What this file has done since we first saw it

Other commands, from other repositories

dashboard-list-models

dashboard-server-tunnel-off

dashboard-session-abort-all

dashboard-session-diff

dashboard-flow-auto

dashboard-session-rename