Problem

A restore command failing with a non-zero exit code (e.g. poetry lock exit 1) did not stop the scan, even with --stop-on-error.

Root cause — failure-sentinel mismatch:

• shell() signals a non-zero exit by returning None (catches CalledProcessError, logs, returns None).
• execute_commands dropped that None via if command_output: and joined an empty list into '' — an empty-string success.
• try_restore_dependencies only checks if output is None, so '' was treated as success and a Document was returned.
• restore() therefore never returned None, making the --stop-on-error escalation in _try_restore_dependencies unreachable for a clean non-zero exit.

Fix

execute_commands now treats shell() → None as a failed command and returns None (short-circuiting remaining commands). Propagation is restored: fail → None all the way up → FileCollectionError raised under --stop-on-error.

Tests

Existing stop-on-error tests all mocked execute_commands → None, so they never covered the production path where a real non-zero exit produced ''. Added:

• TestExecuteCommands — real execute_commands with only shell() mocked: fail→None, short-circuit at first failure, empty-output success ≠ failure, joins outputs.
• test_shell_failure_propagates_to_none_and_no_lockfile — e2e through try_restore_dependencies.

All 27 SCA restore/collector tests pass.

🤖 Generated with Claude Code