fix: address CodeRabbit review on stats exclusion and tests

- Enforce exclusion rules on GET .../stats (parity with session detail)

- Clarify API error envelope exception for project sessions 400

- MD040 fences, CLI subprocess timeout, stricter search hit keys

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: clean6378-max-it

README.md

@@ -98,7 +98,7 @@ Reads from `~/.claude/projects/` which contains JSONL session files created by C
 
 See **[`docs/architecture.md`](docs/architecture.md)** for layered design, data flow, and the dispatch-table ordering rationale.
 
-```
+```text
 claude-code-chat-browser/
 ├── app.py                    # Flask entry point (default port 5000)
 ├── api/

api/sessions.py

@@ -74,6 +74,13 @@ def get_session_stats(project_name: str, session_id: str) -> FlaskReturn:
 
     try:
         session = parse_session(filepath)
+        rules = current_app.config.get("EXCLUSION_RULES") or []
+        if is_session_excluded(rules, session, project_name):
+            return error_response(
+                ErrorCode.SESSION_NOT_FOUND,
+                "Session not found",
+                404,
+            )
     except _PARSE_ERRORS:
         current_app.logger.exception("Failed to parse session %s", session_id)
         return error_response(

docs/api-reference.md

@@ -16,7 +16,7 @@ None. The server binds to `127.0.0.1` by default and reads `~/.claude/projects/`
 
 ## Error envelope
 
-Every `4xx` and `5xx` response from `/api/*` uses this shape:
+Most `/api/*` error responses use this shape:
 
 ```json
 {
@@ -25,6 +25,14 @@ Every `4xx` and `5xx` response from `/api/*` uses this shape:
 }
 ```
 
+**Exception (no `{error, code}` body):**
+
+| Endpoint | Status | Body |
+|----------|--------|------|
+| `GET /api/projects/<project_name>/sessions` | 400 | `[]` (empty JSON array) when `project_name` fails path validation |
+
+All other documented error paths below use the structured envelope.
+
 Extra fields may appear for specific codes (for example `since` on invalid bulk-export mode).
 
 | Field | Stability | Notes |

docs/architecture.md

@@ -4,7 +4,7 @@
 
 ## Component diagram
 
-```
+```text
                     ┌─────────────────────────────┐
                     │  ~/.claude/projects/      │
                     │    <project>/*.jsonl      │  (read-only data source)

tests/test_search.py

@@ -22,7 +22,7 @@ def _assert_search_hits(results: list, *, max_items: int) -> None:
     assert len(results) <= max_items
     for item in results:
         assert isinstance(item, dict)
-        assert _SEARCH_HIT_KEYS.issubset(item.keys())
+        assert set(item.keys()) == _SEARCH_HIT_KEYS
 
 
 def test_limit_integer_string(client_single):
@@ -50,9 +50,12 @@ def test_limit_default(client_single):
 
 
 def test_limit_whitespace_defaults(client_single):
-    resp = client_single.get("/api/search?q=Hello&limit=%20%20%20")
-    assert resp.status_code == 200
-    _assert_search_hits(resp.get_json(), max_items=50)
+    resp_default = client_single.get("/api/search?q=Hello")
+    resp_ws = client_single.get("/api/search?q=Hello&limit=%20%20%20")
+    assert resp_ws.status_code == 200
+    assert resp_default.status_code == 200
+    _assert_search_hits(resp_ws.get_json(), max_items=50)
+    assert len(resp_ws.get_json()) == len(resp_default.get_json())
 
 
 def test_limit_zero(client_single):