test(e2e): port threat-feed + oops sections + CLI top-level checks

Three small focused files instead of a 'misc' catch-all (each one names
exactly what it tests):

- threat-feed.e2e.test.mts (6 tests): help / dry-run / interactive
  default / --no-interactive / --json contract / --markdown.
- oops.e2e.test.mts (3 tests): deliberate-failure command; no-arg
  exits 1 by design.
- cli-help.e2e.test.mts (2 tests): --version (lenient on the known
  exit-2 quirk) and --help (must list 'Main commands'). Absorbed from
  the (next commit's) critical-commands.e2e.test.mts deletion.

Author: jdalton

packages/cli/test/e2e/cli-help.e2e.test.mts

@@ -0,0 +1,33 @@
+/**
+ * @file E2E tests for the Socket CLI's top-level `--help` / `--version`
+ *   behavior. Absorbed from the (now-deleted) critical-commands.e2e.test.mts
+ *   "Basic commands (no auth required)" group.
+ *
+ *   No auth required.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { ENV } from '../../src/constants/env.mts'
+import { executeCliCommand } from '../helpers/cli-execution.mts'
+
+const RUN = ENV.RUN_E2E_TESTS
+
+describe('socket CLI top-level (e2e)', () => {
+  it.skipIf(!RUN)('--version produces output (known quirk: may exit 2)', async () => {
+    // Note: --version currently shows help and exits with code 2 (known
+    // issue). This test validates the CLI executes without crashing — the
+    // exact exit code is intentionally lenient so the test doesn't break
+    // when the quirk is fixed.
+    const result = await executeCliCommand(['--version'], { isolateConfig: false })
+    expect(result.code).toBeGreaterThanOrEqual(0)
+    expect(result.stdout.length).toBeGreaterThan(0)
+  })
+
+  it.skipIf(!RUN)('--help exits 0 and lists main commands', async () => {
+    const result = await executeCliCommand(['--help'], { isolateConfig: false })
+    expect(result.code).toBe(0)
+    expect(result.stdout).toContain('socket')
+    expect(result.stdout).toContain('Main commands')
+  })
+})

packages/cli/test/e2e/oops.e2e.test.mts

@@ -0,0 +1,33 @@
+/**
+ * @file E2E tests for `socket oops`. Ported from
+ *   `packages/cli/test/smoke.sh`'s oops section (4 commands).
+ *
+ *   `oops` is a deliberate-failure command used in regression tests; the
+ *   no-arg form exits 1 by design.
+ *
+ *   Gated on `RUN_E2E_TESTS=1`.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { ENV } from '../../src/constants/env.mts'
+import { executeCliCommand } from '../helpers/cli-execution.mts'
+
+const RUN = ENV.RUN_E2E_TESTS
+
+describe('socket oops (e2e)', () => {
+  it.skipIf(!RUN)('oops (no args) exits 1 by design', async () => {
+    const result = await executeCliCommand(['oops'])
+    expect(result.code).toBe(1)
+  })
+
+  it.skipIf(!RUN)('oops --help exits 0', async () => {
+    const result = await executeCliCommand(['oops', '--help'])
+    expect(result.code).toBe(0)
+  })
+
+  it.skipIf(!RUN)('oops --dry-run exits 0', async () => {
+    const result = await executeCliCommand(['oops', '--dry-run'])
+    expect(result.code).toBe(0)
+  })
+})

packages/cli/test/e2e/threat-feed.e2e.test.mts

@@ -0,0 +1,53 @@
+/**
+ * @file E2E tests for `socket threat-feed`. Ported from
+ *   `packages/cli/test/smoke.sh`'s threat-feed section (6 commands).
+ *
+ *   threat-feed is interactive by default; smoke.sh notes a "potential
+ *   caching issue" on the first run. The non-interactive forms drive the
+ *   tests here.
+ *
+ *   Gated on `RUN_E2E_TESTS=1`. Auth required.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { ENV } from '../../src/constants/env.mts'
+import {
+  executeCliCommand,
+  validateSocketJsonContract,
+} from '../helpers/cli-execution.mts'
+
+const RUN = ENV.RUN_E2E_TESTS
+
+describe('socket threat-feed (e2e, auth required)', () => {
+  it.skipIf(!RUN)('threat-feed --help exits 0', async () => {
+    const result = await executeCliCommand(['threat-feed', '--help'])
+    expect(result.code).toBe(0)
+  })
+
+  it.skipIf(!RUN)('threat-feed --dry-run exits 0', async () => {
+    const result = await executeCliCommand(['threat-feed', '--dry-run'])
+    expect(result.code).toBe(0)
+  })
+
+  it.skipIf(!RUN)('threat-feed (interactive default) exits 0', async () => {
+    const result = await executeCliCommand(['threat-feed'])
+    expect(result.code).toBe(0)
+  })
+
+  it.skipIf(!RUN)('threat-feed --no-interactive exits 0', async () => {
+    const result = await executeCliCommand(['threat-feed', '--no-interactive'])
+    expect(result.code).toBe(0)
+  })
+
+  it.skipIf(!RUN)('threat-feed --json conforms to contract', async () => {
+    const result = await executeCliCommand(['threat-feed', '--json'])
+    expect(result.code).toBe(0)
+    validateSocketJsonContract(result.stdout, 0)
+  })
+
+  it.skipIf(!RUN)('threat-feed --markdown exits 0', async () => {
+    const result = await executeCliCommand(['threat-feed', '--markdown'])
+    expect(result.code).toBe(0)
+  })
+})