lis186 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+### Breaking (3.0.0)
+
+- **`ccxray setup` is record-only by default; export is opt-in (#691).** Plain `ccxray setup` installs the Claude shell wrapper and local recording settings (`LOG_RETENTION_DAYS`, `CCXRAY_IMPORT_DISABLE=1`) only. It writes no export settings, enrollment, or cursor, needs no `--bucket`/`--domains`, and never reads gcloud Application Default Credentials. Enable summary export with `ccxray setup --export --bucket <bucket> --domains <domain>`, which behaves exactly as setup did in 2.x; `--bucket`, `--domains`, `--prefix`, and `--cwd-allowlist` are refused without `--export`. Upgrades keep exporting: an install whose shell block already exports stays exporting when `ccxray setup` is re-run without `--export`. Setup leaves that block byte-for-byte unchanged, does not read gcloud credentials or rewrite `export-enrollment.json`, and prints one line per such shell naming `ccxray setup --export` (refresh and keep exporting) and `ccxray setup --remove` (stop). With several shell targets each is handled on its own, so a record-only shell is never rewritten as an export block and a mixed install no longer fails with "--export needs --bucket"; `--export` takes bucket and domains from the existing export block. `ccxray setup --check` skips the ADC check when export is not configured. `ccxray setup --help` documents both modes.
+- **Context HUD is off by default; new `ccxray hud on|off|status` (#692).** The HUD footer can truncate subagent returns, so a missing `statusLine` setting now means off. A `settings.json` with an explicit `"statusLine": true` keeps the HUD on after upgrading. Note that the dashboard used to persist the then-default `true` whenever it saved settings (for example when starring), so such homes keep the HUD on; run `ccxray hud off` to turn it off. `ccxray hud on|off` writes the same `<CCXRAY_HOME>/settings.json` the dashboard toggle uses (atomically through a symlinked file, owner-only, keeping the other settings, and refusing a file that is not a JSON object; `hud status` on such a file reports it and exits non-zero); a running hub or server applies a CLI change when it restarts, while the dashboard toggle still applies immediately. Dashboard writes patch only the keys they change into the file as it is on disk, so they no longer revert a `ccxray hud on|off` made while the server runs. The `Context HUD: enabled|disabled` line is printed only by proxy startup, standalone agent launches, and `ccxray hud status`, not by other subcommands.
+
 ### Fixed
 
 - **Codex ChatGPT-login works through ccxray again (#671).** Codex 0.159.2 and 0.163.0 failed to start with `-32603 workspace routing discovery failed`, because the launcher pointed `chatgpt_base_url` at the plaintext loopback proxy. In ChatGPT-OAuth mode `ccxray codex` and the Herdr Codex launch now set only `openai_base_url=<proxy>/v1`: account and workspace-discovery calls go directly to chatgpt.com, and model traffic is still recorded. API-key mode is unchanged. `ccxray codex` warns (read-only) when `$CODEX_HOME/config.toml` still points `chatgpt_base_url` at a loopback proxy, which keeps failing. Residency/`us` workspaces are not re-routed for the local proxy. See [notes](docs/codex-workspace-routing.md).

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -16,7 +16,9 @@ ccxray grok                                      # Proxy + Grok CLI (xAI)
 ccxray --port 8080 claude                        # Custom port (opts out of hub, independent server)
 ccxray status                                    # Show process, export, home, and hub status
 ccxray --port 8080 status                        # Checks hub lock/socket first; probes this port only if no lock exists
-ccxray setup --bucket <bucket> --domains example.com # Export settings + Claude wrapper; import stays disabled
+ccxray setup                                     # Claude wrapper + local recording only; import stays disabled
+ccxray setup --export --bucket <bucket> --domains example.com # Also enroll in summary export (opt-in)
+ccxray hud on|off|status                         # Context HUD toggle (off by default; same settings.json as the dashboard)
 ccxray                                           # Proxy + dashboard only
 npm run dev                                      # Dev mode (auto-restart on server/public changes)
 npm test                                         # Run tests

diff --git a/README.ja.md b/README.ja.md
@@ -33,19 +33,25 @@ npx ccxray grok
 
 ccxray が proxy を読み込めない、または hub に接続できない場合、agent を直接起動し、その session は記録されません。hub 接続の予算時間はデフォルトで 3000 ms です。未解決の接続は時間切れで fallback し、それより前に失敗すれば早く fallback します。`CCXRAY_ATTACH_TIMEOUT_MS` で予算時間を変更できます。ccxray は `<CCXRAY_HOME>/fail-open.log`（デフォルトは `~/.ccxray/fail-open.log`）への記録を試みますが、書き込みは best effort で失敗することもあります。`CCXRAY_FAIL_CLOSED=1` を設定すると、fallback せずに起動を停止します。Claude の `--bg` / `--background` launch は仕様上 proxy を通りません。
 
-Claude の shell wrapper と任意のサマリー出力を設定して継続利用する場合：
-
-`setup` を実行する前に Claude Code をインストールし、ログイン済みアカウントのメールアドレスを ccxray が取得できることを確認してください。`--domains` のリストにはそのアカウントのドメインを含めます。setup には読み取り可能な gcloud Application Default Credentials も必要です。先に `gcloud auth application-default login` を実行してください。exporter 自体は service-account key file に対応していますが、setup は `CCXRAY_EXPORT_GCS_KEY_FILE` を拒否します。
+Claude の shell wrapper を設定して継続利用する場合（ローカル記録のみ）：
 
 ```bash
 npm install -g ccxray
-gcloud auth application-default login
-ccxray setup --bucket "<bucket>" --domains example.com --cwd-allowlist "project-a,project-b" --retention-days 30
+ccxray setup
 # 新しいターミナルを開く（または shell profile を再読み込み）し、設定を確認：
 ccxray setup --check
 ```
 
-`setup` は shell profile に Claude wrapper と出力設定を追加し、ログ保持期間を設定して `CCXRAY_IMPORT_DISABLE=1` を書き込みます。Codex wrapper は追加しません。`ccxray setup --dry-run`（同じ setup オプションを指定）で変更をプレビューできます。`ccxray setup --remove` は ccxray が書き込んだ shell block を削除して tombstone を書き、今後のアップロードを停止します。ローカルログやアップロード済みサマリーは削除しません。詳細は[エクスポート設定ガイド](docs/export-onboarding.md)を参照してください。
+`ccxray setup` だけでは出力設定を書き込まず、bucket・domains・gcloud 認証情報も不要です。GCS へのサマリー出力は `--export` で明示的に有効にします。使用前に Claude Code をインストールし、ログイン済みアカウントのメールアドレスを ccxray が取得できることを確認してください。`--domains` のリストにはそのアカウントのドメインを含めます。出力の設定には読み取り可能な gcloud Application Default Credentials も必要です。先に `gcloud auth application-default login` を実行してください。exporter 自体は service-account key file に対応していますが、setup は `CCXRAY_EXPORT_GCS_KEY_FILE` を拒否します。
+
+```bash
+gcloud auth application-default login
+ccxray setup --export --bucket "<bucket>" --domains example.com --cwd-allowlist "project-a,project-b" --retention-days 30
+```
+
+すでに出力が有効なインストール（2.x で設定）は、`--export` なしで `ccxray setup` を再実行しても出力を続けます。setup はその旨を 1 行表示します。
+
+`setup` は shell profile に Claude wrapper（`--export` 指定時は出力設定も）を追加し、ログ保持期間を設定して `CCXRAY_IMPORT_DISABLE=1` を書き込みます。Codex wrapper は追加しません。`ccxray setup --dry-run`（同じ setup オプションを指定）で変更をプレビューできます。`ccxray setup --remove` は ccxray が書き込んだ shell block を削除して tombstone を書き、今後のアップロードを停止します。ローカルログやアップロード済みサマリーは削除しません。詳細は[エクスポート設定ガイド](docs/export-onboarding.md)を参照してください。
 
 launcher の引数は provider registry で管理されています。現在 `claude`・`codex`・`grok` に対応。未知の provider コマンドは即座に失敗し、未設定のプロキシが静かに起動することはありません。
 
@@ -218,9 +224,9 @@ ccxray は Anthropic の `cache_creation` 使用量フィールドを読み取
 
 ### Context HUD
 
-オプションのコンテキスト統計フッターを Claude Code 内の Claude の応答末尾に追加できます: `📊 Context: 28% (290k/1M) | 1k in + 800 out | Cache 99% hit | $0.15`。デフォルトで有効。ダッシュボードのトップバーから切り替え可能です。
+オプションのコンテキスト統計フッターを Claude Code 内の Claude の応答末尾に追加できます: `📊 Context: 28% (290k/1M) | 1k in + 800 out | Cache 99% hit | $0.15`。デフォルトは無効です（3.0.0 以降）。`ccxray hud on` またはダッシュボードのトップバーで有効にし、`ccxray hud status` で確認、`ccxray hud off` で無効にできます。
 
-**なぜ切り替えが必要なのか?** 親エージェントが Agent / Task ツール経由で sub-agent を呼び出す場合、追加されるブロックが sub-agent の応答を親エージェントに返る前に切り詰めてしまい、マルチエージェントワークフローでデータが静かに失われる可能性があります。sub-agent を多用するセッションでは HUD を無効にしてください。状態は `~/.ccxray/settings.json` に保存されます。
+**なぜ切り替えが必要なのか?** 親エージェントが Agent / Task ツール経由で sub-agent を呼び出す場合、追加されるブロックが sub-agent の応答を親エージェントに返る前に切り詰めてしまい、マルチエージェントワークフローでデータが静かに失われる可能性があります。sub-agent を多用するセッションや自動化されたセッションでは HUD を無効のままにしてください。状態は `~/.ccxray/settings.json` に保存されます（CLI とダッシュボードの切り替えで共有）。そこで明示的に `"statusLine": true` を設定している場合は、アップグレード後も有効のままです。実行中の hub や server は再起動後に CLI の変更を反映し、ダッシュボードの切り替えは即座に反映されます。
 
 ### ずっと残すための Star
 

diff --git a/README.md b/README.md
@@ -33,21 +33,27 @@ The proxy starts, the selected CLI launches through it, and the dashboard opens
 
 If ccxray cannot load the proxy or attach to a hub, it starts the agent directly and that session is not recorded. The hub attach budget is 3000 ms by default; an unresolved attach falls back when the budget expires, and an earlier failure can fall back sooner. Set `CCXRAY_ATTACH_TIMEOUT_MS` to change the budget. ccxray attempts to append a fallback record to `<CCXRAY_HOME>/fail-open.log` (default `~/.ccxray/fail-open.log`), but writing that file is best effort. Set `CCXRAY_FAIL_CLOSED=1` to stop instead of falling back. Claude `--bg` / `--background` launches bypass the proxy by design.
 
-For a persistent install with Claude's shell wrapper and optional summary export:
-
-Before running `setup`, install Claude Code and make sure its logged-in account email is available to ccxray. The `--domains` list must include that account's domain. Setup also requires readable gcloud Application Default Credentials; run `gcloud auth application-default login` first. Setup rejects `CCXRAY_EXPORT_GCS_KEY_FILE`, even though the exporter itself supports a service-account key file.
+For a persistent install with Claude's shell wrapper (local recording only):
 
 ```bash
 npm install -g ccxray
-gcloud auth application-default login
-ccxray setup --bucket "<bucket>" --domains example.com --cwd-allowlist "project-a,project-b" --retention-days 30
+ccxray setup
 # Open a new terminal (or reload your shell profile), then verify:
 ccxray setup --check
 ```
 
+Plain `ccxray setup` writes no export settings and needs no bucket, domains, or gcloud credentials. Summary export to GCS is opt-in with `--export`. Before using it, install Claude Code and make sure its logged-in account email is available to ccxray. The `--domains` list must include that account's domain. Export setup also requires readable gcloud Application Default Credentials; run `gcloud auth application-default login` first. Setup rejects `CCXRAY_EXPORT_GCS_KEY_FILE`, even though the exporter itself supports a service-account key file.
+
+```bash
+gcloud auth application-default login
+ccxray setup --export --bucket "<bucket>" --domains example.com --cwd-allowlist "project-a,project-b" --retention-days 30
+```
+
+An install that already exports (set up by 2.x) keeps exporting when `ccxray setup` is re-run without `--export`: setup leaves its export block unchanged, does not read credentials or rewrite enrollment, and prints one line naming `ccxray setup --export` (refresh) and `ccxray setup --remove` (stop).
+
 Transcript import is off by default on fresh installs and upgrades, in both hub and standalone mode. Set `CCXRAY_IMPORT_DISABLE=0` before starting ccxray or Herdr to opt in to automatic transcript import (restart an existing hub to apply it). For a one-time import, run `ccxray import --once`. `CCXRAY_IMPORT_DISABLE=1` blocks even explicit imports; unset it for a one-time import. Existing indexed history remains available.
 
-`setup` adds a Claude wrapper and export settings to your shell profile, sets log retention, and writes `CCXRAY_IMPORT_DISABLE=1`. It does not install a Codex wrapper. Preview changes with `ccxray setup --dry-run` (include the same setup options). `ccxray setup --remove` removes ccxray's shell block and writes a tombstone to stop future uploads; it does not delete local logs or uploaded summaries. See the [export onboarding guide](docs/export-onboarding.md) for the data and removal details.
+`setup` adds a Claude wrapper to your shell profile (plus export settings with `--export`), sets log retention, and writes `CCXRAY_IMPORT_DISABLE=1`. It does not install a Codex wrapper. Preview changes with `ccxray setup --dry-run` (include the same setup options). `ccxray setup --remove` removes ccxray's shell block and writes a tombstone to stop future uploads; it does not delete local logs or uploaded summaries. See the [export onboarding guide](docs/export-onboarding.md) for the data and removal details.
 
 ### Herdr plugin
 
@@ -220,9 +226,9 @@ Pause requests before they reach Anthropic. Toggle intercept on a session and th
 
 ### Context HUD
 
-Optional context-stats footer appended to Claude's responses inside Claude Code itself: `📊 Context: 28% (290k/1M) | 1k in + 800 out | Cache 99% hit | $0.15`. Enabled by default; toggle from the dashboard topbar.
+Optional context-stats footer appended to Claude's responses inside Claude Code itself: `📊 Context: 28% (290k/1M) | 1k in + 800 out | Cache 99% hit | $0.15`. Off by default (since 3.0.0); turn it on with `ccxray hud on` or from the dashboard topbar, check it with `ccxray hud status`, and turn it off with `ccxray hud off`.
 
-**Why a toggle?** When the parent agent calls sub-agents (Agent / Task tool), the appended block can truncate the sub-agent's response before it's returned to the parent — causing silent data loss in multi-agent workflows. Turn the HUD off when running sub-agent-heavy sessions. State persists in `~/.ccxray/settings.json`.
+**Why a toggle?** When the parent agent calls sub-agents (Agent / Task tool), the appended block can truncate the sub-agent's response before it's returned to the parent — causing silent data loss in multi-agent workflows. Keep the HUD off for sub-agent-heavy or automated sessions. State persists in `~/.ccxray/settings.json` (shared by the CLI and the dashboard toggle); an explicit `"statusLine": true` there stays enabled after upgrading. A running hub or server picks up a CLI change when it restarts; the dashboard toggle applies immediately.
 
 ### Star to Keep Forever
 
@@ -321,7 +327,7 @@ Every environment variable, with its default and source file, is listed in [docs
 
 Raw request and response logs are stored locally in `LOGS_DIR` (by default `~/.ccxray/logs/`) as `{timestamp}_req.json` and `{timestamp}_res.json`. Upgrading from v1.0? Logs previously in `./logs/` are automatically migrated on first run.
 
-If you configure export with `ccxray setup`, ccxray can upload daily and per-session summaries; it does not upload the raw request/response logs. Summaries can include user identity, session IDs, repository basenames, model names, and tool or skill names. Source-derived names and metadata are not comprehensively scrubbed, so review them before enabling export. `CCXRAY_EXPORT_CWD_ALLOWLIST` masks an unlisted repository name as `[other]`; it does not exclude that session. Export requires a non-empty `CCXRAY_EXPORT_DOMAINS`; without it, uploads are blocked and the cursor is preserved. Only turns carrying a matching Claude launch-account snapshot are exported. Codex and Grok launches do not carry that snapshot and are excluded by this filter; this is the intended behavior. See the [export onboarding guide](docs/export-onboarding.md) for fields, filtering, and removal.
+If you configure export with `ccxray setup --export`, ccxray can upload daily and per-session summaries; it does not upload the raw request/response logs. Summaries can include user identity, session IDs, repository basenames, model names, and tool or skill names. Source-derived names and metadata are not comprehensively scrubbed, so review them before enabling export. `CCXRAY_EXPORT_CWD_ALLOWLIST` masks an unlisted repository name as `[other]`; it does not exclude that session. Export requires a non-empty `CCXRAY_EXPORT_DOMAINS`; without it, uploads are blocked and the cursor is preserved. Only turns carrying a matching Claude launch-account snapshot are exported. Codex and Grok launches do not carry that snapshot and are excluded by this filter; this is the intended behavior. See the [export onboarding guide](docs/export-onboarding.md) for fields, filtering, and removal.
 
 ## Docker