fix: remove code exec as default and sec improvements

tests/api/user/test_artifacts_routes.py

@@ -609,6 +609,9 @@ class TestDownloadArtifact:
         assert resp.status_code == 200
         assert resp.json["success"] is True
         assert resp.json["url"].startswith("https://signed.example/")
+        # The envelope carries a distinctive media type so the client keys off
+        # a server signal, not the JSON body shape (open-redirect gadget guard).
+        assert resp.mimetype == "application/vnd.docsgpt.artifact-url+json"
 
     def test_stranger_denied(self, _patch_db, flask_app, monkeypatch):
         from application.api.user.artifacts.routes import DownloadArtifact

tests/api/user/test_tasks.py

@@ -276,7 +276,7 @@ class TestSetupPeriodicTasks:
 
         setup_periodic_tasks(sender)
 
-        assert sender.add_periodic_task.call_count == 12
+        assert sender.add_periodic_task.call_count == 13
 
         calls = sender.add_periodic_task.call_args_list
 
@@ -311,6 +311,9 @@ class TestSetupPeriodicTasks:
         # sandbox session reaper (60s)
         assert calls[11][0][0] == timedelta(seconds=60)
         assert calls[11][1].get("name") == "reap-sandbox-sessions"
+        # stale workflow-run reaper (5m)
+        assert calls[12][0][0] == timedelta(seconds=300)
+        assert calls[12][1].get("name") == "reap-stale-workflow-runs"
 
 
 class TestMcpOauthTask: