fix: preserve task stop intent and guard remote execution boundaries

backend/tests/test_startup_actions.py

@@ -4,7 +4,7 @@ import unittest
 from types import SimpleNamespace
 
 from fastapi import HTTPException
-from routes.assistants import _validate_startup_actions
+from routes.assistants import _validate_startup_actions, _validate_tool_bindings
 from models import RuntimeToolBinding
 from schemas import AssistantUpsert
 from services.config_resolver import (
@@ -81,6 +81,12 @@ class FakeToolCatalogSession:
 
 
 class StartupActionValidationTests(unittest.IsolatedAsyncioTestCase):
+    async def test_task_tools_are_rejected_in_literal_startup_actions(self):
+        tool = SimpleNamespace(id="tool_task", name="后台任务", function_name="coding_task", type="task", status="active", definition={"config": {}})
+        body = AssistantUpsert(name="任务启动动作", startup={"actions": [{"id": "coding", "toolBinding": {"toolId": tool.id, "argumentBindings": {"instruction": {"source": "literal", "value": "编辑仓库"}}}}]})
+        with self.assertRaisesRegex(HTTPException, "不支持启动 Action"):
+            await _validate_tool_bindings(FakeToolCatalogSession([tool]), body)
+
     def test_runtime_pool_includes_bound_and_startup_only_tools(self):
         self.assertEqual(
             _runtime_tool_ids(