diff --git a/.task/feature-permission-hooks.md b/.task/feature-permission-hooks.md
new file mode 100644
index 00000000..ec38f9dc
--- /dev/null
+++ b/.task/feature-permission-hooks.md
@@ -0,0 +1,29 @@
+# feature/permission-hooks 任务卡
+
+任务主记录：https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/173 ；状态：进行中；owner：weichen
+
+## 基线与授权
+
+- 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 6bedf75746d4465ef36a4b129b9859769d1c340d
+- 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-permission-hooks（worktree）；分支：feature/permission-hooks
+- 授权与交付终点：改 core、agent-native、agent-squad、backend、frontend、ui 与 Dev gitlink；开 PR、合入、task-finish。不改发布、不改写历史、不做绕过一切确认的模式。
+
+## 目标与非目标
+
+- 目标：三种权限模式（计划 / 默认 / 自动改文件）；规则 deny > ask > allow；HookBus；ask_user 与 exit_plan_mode；确认卡显示参数并提供本会话始终允许；小队成员透传同一套门禁。
+- 非目标：绕过确认、进程级钩子、MCP OAuth、回滚文件、代码编排。
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at |
+|---|---|---|---|
+| 启动 | 6bedf75746d4465ef36a4b129b9859769d1c340d | 6bedf75746d4465ef36a4b129b9859769d1c340d | 2026-10-03T16:43:41Z |
+
+## 结果与验证（完成后填写）
+
+- 结果：native 0a52d9f，squad beea97e，core cf7df54，backend ce95cd1，frontend 0eaced4，ui aa67088。
+- 验证：make test 通过。计划模式拒绝 write_artifact，默认模式仍执行。钩子适配与原回调的停止原因、提醒次数、拒绝次数一致。
+- 影响与剩余项：高风险 shell 在默认模式下改为询问。没有绕过确认的模式。
+| 同步前验收 | 6bedf75746d4465ef36a4b129b9859769d1c340d | 2e558e4733663c56e7aee867795fdbf079cd6079 | 2026-10-03T17:06:35Z |
+| 同步前验收 | 6bedf75746d4465ef36a4b129b9859769d1c340d | 4349d5ea81000b03acae8d1152ecadea7887ba60 | 2026-10-03T17:06:36Z |
+| 同步前验收 | 6bedf75746d4465ef36a4b129b9859769d1c340d | 245fe39b931e4364e19bac4f0a371d440a3826b8 | 2026-10-03T17:06:38Z |
diff --git a/deps/agent-native b/deps/agent-native
index 6fd1d441..0a52d9f9 160000
--- a/deps/agent-native
+++ b/deps/agent-native
@@ -1 +1 @@
-Subproject commit 6fd1d441a95423e27be6f6159207d5d0821bec4d
+Subproject commit 0a52d9f9763372ef1b4d061934d60f15fd8bcbea
diff --git a/deps/agent-squad b/deps/agent-squad
index 4d534508..beea97e8 160000
--- a/deps/agent-squad
+++ b/deps/agent-squad
@@ -1 +1 @@
-Subproject commit 4d534508a94c59cf865549125a9cdf1303271a22
+Subproject commit beea97e8cf8f509289545827bc3034a940433ca4
diff --git a/modules/backend b/modules/backend
index 7bef7a4f..ce95cd13 160000
--- a/modules/backend
+++ b/modules/backend
@@ -1 +1 @@
-Subproject commit 7bef7a4f9462fbb976f6bd9b544079a6ef10b030
+Subproject commit ce95cd1355e31317ca8a585db43f66bd8767d910
diff --git a/modules/core b/modules/core
index 7c66075e..cf7df548 160000
--- a/modules/core
+++ b/modules/core
@@ -1 +1 @@
-Subproject commit 7c66075ee9caa9f990d6d6ad7619f7af8d9040e8
+Subproject commit cf7df54874c20f8ae9cb4e48b2c75f9ef6968f14
diff --git a/modules/frontend b/modules/frontend
index 5961b6e9..0eaced4d 160000
--- a/modules/frontend
+++ b/modules/frontend
@@ -1 +1 @@
-Subproject commit 5961b6e9bdb91d3d27be505d357bfb4f6b4c18d0
+Subproject commit 0eaced4d5acc73a5eabc6007271aeeaf986114aa
diff --git a/modules/ui b/modules/ui
index 9c034575..aa67088d 160000
--- a/modules/ui
+++ b/modules/ui
@@ -1 +1 @@
-Subproject commit 9c0345750600bd14f1b3144bb37819df97830fc1
+Subproject commit aa67088d5485d50f5f56c3073b99b5b1162d9131