Add TODO comments for remaining test failures

Document 8 failing tests across 7 test files with TODO comments:
- cmd-scan-create.test.mts: scan create with zero timeout
- cmd-analytics.test.mts: analytics with --dry-run
- cmd-yarn.test.mts: yarn install with --dry-run
- cmd-fix.test.mts: fix with CVE ID conversion
- cmd-pnpm.test.mts: pnpm add/install tests (3 tests)
- cmd-login-smoke.test.mts: login --help
- cmd-manifest-cdxgen.test.mts: cdxgen unknown flag forwarding (3 tests)

These tests require further investigation to determine root causes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: jdalton

src/commands/analytics/cmd-analytics.test.mts

@@ -125,6 +125,8 @@ describe('socket analytics', async () => {
     },
   )
 
+  // TODO: Fix test failure - analytics with --dry-run without args
+  // Test may be timing out or failing on snapshot mismatch
   cmdit(
     ['analytics', FLAG_DRY_RUN, FLAG_CONFIG, '{"apiToken":"fakeToken"}'],
     'should run to dryrun without args',

src/commands/fix/cmd-fix.test.mts

@@ -481,6 +481,8 @@ describe('socket fix', async () => {
       FLAG_CONFIG,
       '{"apiToken":"fake-token"}',
     ],
+    // TODO: Fix test failure - fix command with CVE ID conversion for lodash vulnerability
+    // Test may be failing due to API mocking or CVE lookup issues
     'should handle CVE ID conversion for lodash vulnerability',
     async cmd => {
       const { cleanup, tempDir } = await withTempFixture(

src/commands/login/cmd-login-smoke.test.mts

@@ -9,6 +9,8 @@ describe('socket login - smoke test scenarios', () => {
   })
 
   describe('basic functionality', () => {
+    // TODO: Fix test failure - login --help command
+    // Test may be failing due to snapshot mismatch or output format changes
     it('should show help: `login --help`', async () => {
       const result = await runWithConfig('login', '--help')
       expect(result.exitCode).toBe(0)

src/commands/manifest/cmd-manifest-cdxgen.test.mts

@@ -154,6 +154,8 @@ describe('socket manifest cdxgen', async () => {
       },
     )
 
+    // TODO: Fix test failure - cdxgen unknown short flag forwarding
+    // Test may be timing out or failing due to command forwarding logic changes
     it('should not forward an unknown short flag to cdxgen', async () => {
       const command = '-u'
       await expect(
@@ -168,6 +170,8 @@ describe('socket manifest cdxgen', async () => {
       )
     })
 
+    // TODO: Fix test failure - cdxgen unknown flag forwarding
+    // Test may be timing out or failing due to command forwarding logic changes
     it('should not forward an unknown flag to cdxgen', async () => {
       const command = '--unknown'
       await expect(
@@ -182,6 +186,8 @@ describe('socket manifest cdxgen', async () => {
       )
     })
 
+    // TODO: Fix test failure - cdxgen multiple unknown flags forwarding
+    // Test may be timing out or failing due to command forwarding logic changes
     it('should not forward multiple unknown flags to cdxgen', async () => {
       await expect(
         () =>

src/commands/pnpm/cmd-pnpm.test.mts

@@ -156,6 +156,8 @@ describe('socket pnpm', async () => {
       FLAG_CONFIG,
       '{"apiToken":"fakeToken"}',
     ],
+    // TODO: Fix test failure - pnpm add with --dry-run flag
+    // Test may be failing due to snapshot mismatch or pnpm behavior changes
     'should handle add with --dry-run flag',
     async cmd => {
       const { code, stdout } = await spawnSocketCli(binCliPath, cmd, {
@@ -196,6 +198,8 @@ describe('socket pnpm', async () => {
       FLAG_CONFIG,
       '{"apiToken":"fakeToken"}',
     ],
+    // TODO: Fix test failure - pnpm add scoped packages with version
+    // Test may be failing due to snapshot mismatch or pnpm behavior changes
     'should handle scoped packages with version',
     async cmd => {
       const { code, stdout } = await spawnSocketCli(binCliPath, cmd, {
@@ -222,6 +226,8 @@ describe('socket pnpm', async () => {
       FLAG_CONFIG,
       '{"apiToken":"fakeToken","issueRules":{"malware":true}}',
     ],
+    // TODO: Fix test failure - pnpm install with issueRules for malware
+    // Test may be failing due to API mocking or issueRules behavior changes
     'should handle install with issueRules for malware',
     async cmd => {
       const { code, stdout } = await spawnSocketCli(binCliPath, cmd, {

src/commands/scan/cmd-scan-create.test.mts

@@ -620,6 +620,8 @@ describe('socket scan create', async () => {
     },
   )
 
+  // TODO: Fix test failure - scan create with zero timeout (unlimited)
+  // Test expects exit code 0 but actual behavior may differ
   cmdit(
     [
       'scan',

src/commands/yarn/cmd-yarn.test.mts

@@ -131,6 +131,8 @@ describe('socket yarn', async () => {
     },
   )
 
+  // TODO: Fix test failure - yarn install with --dry-run flag
+  // Test may be failing due to yarn-specific behavior or snapshot mismatch
   cmdit(
     [YARN, 'install', FLAG_DRY_RUN, FLAG_CONFIG, '{"apiToken":"fakeToken"}'],
     'should handle install with --dry-run flag',