test(cli): add predownloadCommand unit tests for coverage

Add 5 tests covering the predownloadCommand async function: successful
pull of all images, api-proxy inclusion, process.exit on failure,
continued pulling after partial failure, and non-Error rejection handling.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Mossaka

src/commands/predownload.test.ts

@@ -1,4 +1,13 @@
-import { resolveImages, PredownloadOptions } from './predownload';
+import { resolveImages, predownloadCommand, PredownloadOptions } from './predownload';
+
+// Mock execa
+jest.mock('execa', () => {
+  const mockExeca = jest.fn().mockResolvedValue({ stdout: '', stderr: '' });
+  return { __esModule: true, default: mockExeca };
+});
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const execa = require('execa').default as jest.Mock;
 
 describe('predownload', () => {
   describe('resolveImages', () => {
@@ -54,4 +63,90 @@ describe('predownload', () => {
       ]);
     });
   });
+
+  describe('predownloadCommand', () => {
+    const defaults: PredownloadOptions = {
+      imageRegistry: 'ghcr.io/github/gh-aw-firewall',
+      imageTag: 'latest',
+      agentImage: 'default',
+      enableApiProxy: false,
+    };
+
+    beforeEach(() => {
+      execa.mockReset();
+      execa.mockResolvedValue({ stdout: '', stderr: '' });
+    });
+
+    it('should pull all resolved images', async () => {
+      await predownloadCommand(defaults);
+
+      expect(execa).toHaveBeenCalledTimes(2);
+      expect(execa).toHaveBeenCalledWith(
+        'docker',
+        ['pull', 'ghcr.io/github/gh-aw-firewall/squid:latest'],
+        { stdio: 'inherit' },
+      );
+      expect(execa).toHaveBeenCalledWith(
+        'docker',
+        ['pull', 'ghcr.io/github/gh-aw-firewall/agent:latest'],
+        { stdio: 'inherit' },
+      );
+    });
+
+    it('should pull api-proxy when enabled', async () => {
+      await predownloadCommand({ ...defaults, enableApiProxy: true });
+
+      expect(execa).toHaveBeenCalledTimes(3);
+      expect(execa).toHaveBeenCalledWith(
+        'docker',
+        ['pull', 'ghcr.io/github/gh-aw-firewall/api-proxy:latest'],
+        { stdio: 'inherit' },
+      );
+    });
+
+    it('should exit with code 1 when a pull fails', async () => {
+      const mockExit = jest.spyOn(process, 'exit').mockImplementation(() => {
+        throw new Error('process.exit called');
+      });
+      execa
+        .mockResolvedValueOnce({ stdout: '', stderr: '' })
+        .mockRejectedValueOnce(new Error('pull failed'));
+
+      await expect(predownloadCommand(defaults)).rejects.toThrow(
+        'process.exit called',
+      );
+
+      expect(mockExit).toHaveBeenCalledWith(1);
+      mockExit.mockRestore();
+    });
+
+    it('should continue pulling remaining images after a failure', async () => {
+      const mockExit = jest.spyOn(process, 'exit').mockImplementation(() => {
+        throw new Error('process.exit called');
+      });
+      execa.mockRejectedValueOnce(new Error('pull failed')).mockResolvedValueOnce({ stdout: '', stderr: '' });
+
+      await expect(predownloadCommand(defaults)).rejects.toThrow(
+        'process.exit called',
+      );
+
+      // Both images should have been attempted
+      expect(execa).toHaveBeenCalledTimes(2);
+      mockExit.mockRestore();
+    });
+
+    it('should handle non-Error rejection', async () => {
+      const mockExit = jest.spyOn(process, 'exit').mockImplementation(() => {
+        throw new Error('process.exit called');
+      });
+      execa.mockRejectedValueOnce('string error').mockResolvedValueOnce({ stdout: '', stderr: '' });
+
+      await expect(predownloadCommand(defaults)).rejects.toThrow(
+        'process.exit called',
+      );
+
+      expect(mockExit).toHaveBeenCalledWith(1);
+      mockExit.mockRestore();
+    });
+  });
 });