v1.2.16 — Alleen opmaak, recepten en de weigerlijst

Added — Alleen opmaak, saved scripts, what the AI may never do

• A new stand under Wijzigingen door de AI: Alleen opmaak (annotation only), in Settings, the mode chip and managed.json
  (ChangeApproval: annotate). The AI makes views, sheets, schedules and annotations; a change that touches a model element is
  rolled back and refused, and it says what it would have changed. A wall, a parameter value or a deleted floor is refused; a tag
  on that wall is not.
• Every exec script that changed the model is kept in full in the project folder (VibeModel\recipes\), with the date, who asked,
  the question and what changed, so a colleague can read, re-run or change it without the AI. When the project folder does not
  answer it goes to a local folder. The journal names the file; recipes lists them and prints one. The chat starts each script with
  what it is for and what it assumed.
• VibeModel refuses, also when asked: moving the project base point or survey point, changing the shared coordinates, unpinning grids,
  levels, links or imports, and editing view templates. A script is checked before it runs and the protected items are compared
  afterwards; a change that gets through anyway is undone, or named with press Ctrl+Z when it cannot be.

Changed

• Locked settings and switched-off features name Revit-beheer (managed by your Revit administrators) instead of IT.
• A failed exec that kept earlier work now gets a journal line (failed; changes kept) and its script is saved.
• A new view counts as one view in the -- changed: line, not as seven elements (its camera, section box and sun settings are left out).
• An exec that is one // line is refused with the reason, instead of reporting success after running nothing.

Fixed

• Checking whether a file on this computer exists no longer waits on a busy thread pool; a missing local file could be reported
  as an unreachable share.

v1.2.15 — Zichtbaar wat er veranderde

Added — see what the AI changed

• After every command that changed the model, one line says what happened, per category:
  -- changed: added 1 (Walls 1), modified 4 (Walls 3, Views 1), deleted 0 (in JSON a changes object
  with counts per category and at most 50 ids per group). A batch gets one line for the whole batch; a new family type counts as Types.
  Not after a preview or a discarded change, which changed nothing. The chat ends such an answer with
  one line built from it: what changed, what it assumed and what it skipped.
• The project journal now says who did it: - 2026-11-09 14:03:12 · by jjansen · wall … · created …
  (the Windows user; also on a discarded change and on each chat question). Older lines stay as they are.

Added — mode chip in the chat input (Cursor-style), next message as preview

• Plan 20. The chat input is one rounded box with a footer row: paperclip, a mode chip and a round
  send arrow. The chip shows how the AI's changes are handled — Automatisch, Vragen (approve
  deletions and edits first) or Alleen lezen — and one click switches it for the rest of the Revit
  session, without opening Settings. In Vragen the send arrow turns amber. IT's managed.json still
  wins (the chip is then greyed); Settings shows the chip's choice and can clear it; Diagnose and
  approvals report it as (this session).
• Volgend bericht als preview in the same menu: the next message runs as a preview — every change
  the AI makes in that turn is rolled back by Revit and reported, and the AI says what it would
  change. Live in Revit 2023: "Verwijder wand …" as a preview turn ran the delete, the wall stayed, and
  the answer said nothing was changed.

Changed

• A list that was cut off now always gives the real total and says it is incomplete, in one wording:
  showing 100 of 312 — incomplete; narrow with filter or --view. Before, list said "100 shown, may
  be more" and library "20 match(es)" with no total. Covers list, filter, familytypes, views,
  whereused, schedule, sheetinfo, docs, library, journal, geometry, loadfamily, pcprobe.
  The chat is told to pass that total on, and to name its assumptions and omissions.
• The chat makes quantities for an estimate or bill as a Revit schedule by default, so anyone can check them
  in Revit without the AI.
• filter --count Type and colorsplash walls Type group by type name instead of ElementId(1571611);
  filter foundations Type contains AZ finds them; a parameter name with spaces can be quoted
  (filter foundations "Type Name" contains AZ).
• A legend already on the sheet is refused with the right reason (a legend can be on several sheets,
  once per sheet).
• Publishing a release now runs the tests first; failing tests stop it.

Fixed

• A short note between two steps ("Ik lees eerst de commando's.") no longer flashes as the answer and
  disappears; it stays in the step list until it proves to be the answer.

v1.2.14 — Update From Inside Revit

Added — Update from inside Revit

• Plan 19. When a newer version is published, the chat pane shows a slim banner: VibeModel 1.2.15
  beschikbaar (2,6 MB) with Bijwerken (Update), Wat is nieuw and Niet nu. Bijwerken downloads
  the release zip in the background, checks its size and SHA-256 against the published manifest, puts
  it in its own version folder and says klaar - actief na het opnieuw starten van Revit. Revit is
  never restarted for you and nothing in the model changes. A download that does not match the
  manifest is refused and nothing is installed. Measured in Revit 2023 with unsigned test builds:
  each new version was active after the next start, and an update did not make Revit ask Always
  Load again.
• A small, stable loader is now what Revit starts (VibeModel.Loader.dll, same add-in id): it
  starts the installed version from %LOCALAPPDATA%\VibeModel\versions\Revit<year>\<version>\, or a
  developer build right next to it, and writes one line per start to logs\loader.log. Updates add a
  version folder and never replace the loader — the only file Revit's security prompt is about.
• Settings → Versie en updates: installed version and loader, where it runs from, the update source,
  Automatisch controleren op updates (once a day, at start), Nu controleren, and Terug naar
  (rollback at the next start; the previous version is kept). Diagnose has an == Updates
  section and shows the loader's signature (what Revit asks about); update, update --install,
  update --rollback do the same from the chat or a terminal.
• A standards pack in <add-in folder>\standards\ is still found: that is Revit's add-ins folder,
  where the loader sits, not the version folder an update replaces.
• For IT: managed.json DisableUpdates (switch it off) and UpdateSource (your own share or https
  mirror of the release assets; an access token in the mirror URL's query is kept for the zip too).
  Each release now carries latest-Revit<year>.json and a .sha256
  next to the zip, and the loader is signed along with the add-in. See Updates in docs/deployment.md.

Changed

• install.cmd installs the loader into the add-ins folder and the add-in into its version folder,
  and removes the add-in an older install left in the add-ins folder. A new version alone installs
  while Revit runs (active after a restart); Revit only has to be closed when the loader changes or
  such old files must go. It never downgrades silently: an older zip is installed next to a newer
  version, which stays active (-AllowDowngrade to switch on purpose) — a login script that re-runs
  the same zip cannot undo an in-app update. This first release with the loader is installed with
  install.cmd once; later versions can come through the app.

Full Changelog: v1.2.13...v1.2.14

v1.2.13 — Start a New Chat in Time

Changed — the chat tells you when to start a new chat

• A colleague hit their Claude subscription's session limit after an answer that showed
  "16.6M tokens · ≈ €33" and asked what the tokens meant. Claude re-reads the whole conversation at
  every step, so a long chat makes every following question expensive — and people new to AI keep
  one chat going all day.
• The line under an answer no longer shows euros: it reads 3.9M tokens, with · lang gesprek and an
  orange dot once the conversation is about twice a fresh chat's size, · zeer lang gesprek and a red
  dot from three times. The tooltip explains what the tokens are, the conversation length, and the
  API-price estimate (which a subscription does not bill per question).
• Once per chat, after a very long one, a bar under the answer explains why and offers Nieuwe chat
  (or Niet nu). The welcome card of an empty chat ends with the tip to start a new chat per task
  (not with a local model, which has no limit).
• Length is judged on how much the turn's last call carried, not on the turn's total — a single first
  question with many tool steps is not a long conversation.

Full Changelog: v1.2.12...v1.2.13

v1.2.12 — Known API Gaps, Labels You Can Finish

Added — apilookup names what Revit's API cannot do

• Plan 18, from a colleague's rebar-tag session: the chat added the shared parameters and the tag
  types but could not make the labels, and only found the workaround when asked. Now apilookup
  (and the hint under a failed exec compile) answers questions about labels in tag, generic
  annotation and title-block families, legend views, and creating phases or design options with a
  Known gap: block: what the API cannot do, what does work (measured in Revit 2023: add the family
  parameter, copy the nearest label, put (LABEL <parameter>) next to it, load the family back) and
  the step the user does by hand (Edit Label). It also warns that setting a label's Label parameter
  reports success and changes nothing. No new prompt rule — only apilookup's one-line description
  names the gaps.
• An exec snippet can now load a family it edited back into the project:
  fd.LoadFamily(doc, new VibeModel.Services.Helpers.KeepValuesLoadOptions()) (the options generated
  families already used, now public; Revit refuses the reload without options).

Fixed

• profile <name> --points … on an existing profile said "PROFILE UPDATED" but every later extrude
  / sweep kept using the old points: the reload keeps the project's type values, so the stored
  points and the change stamp stayed old. Both are now written onto the project types after the
  reload (the loader writes the stamp for every generated family, as extrude already did by hand);
  profile <name> shows the new points and a repeat with the same points says "Unchanged".
• The model-state stamp no longer reports "1 USER edit" for a change an exec snippet made through
  a Revit call that opens its own transaction (loading a family back): whatever is committed while a
  VibeModel command runs counts as VibeModel's.

Full Changelog: v1.2.11...v1.2.12

v1.2.11 — Approve Before Keeping, Composite Profiles, Server Lockdown

Added — approve before keeping, preview, read-only runs (Settings → "Wijzigingen door de AI")

• Plan 15, after pyRevit 7.0's agent runtime (2026-10-06). Off by default: auto keeps every
  answer exactly as it was. ask makes deletions and edits (delete, exec, set, join,
  unjoin, phase, and batches holding one) wait for the user: Revit isolates and selects what
  changed and a window shows the question, the command and the counts by category; Behouden
  keeps it as ONE undo step, Ongedaan maken (or Esc / closing) rolls everything back and tells
  the AI not to retry. "Deze Revit-sessie niet meer vragen" switches it off until Revit closes.
  New elements never ask. readonly refuses every change (READ_ONLY, with what it would have
  changed) — for colleagues who only look.
• ?preview=1 on any modifying command or batch: it runs, says what it would add/modify/delete,
  and rolls everything back (an annotation it would re-host or remove is reported as -- preview:).
  ?readonly=1 (meant for exec/batch) fails (QUERY_MODIFIED_MODEL) instead of changing the model.
• approvals lists this session's decisions; a decision a client missed (it waits up to 10 min,
  then APPROVAL_PENDING) appears once in the next model-state stamp. Discarded runs are journaled.
• The file-based fallback (only used when the HTTP port could not open) cannot ask or roll back, so
  under ask or readonly it refuses changes instead of slipping past the setting.
• IT can set it per machine: ChangeApproval in managed.json (locked in Settings); Diagnose names the
  source; build.ps1 -Approval ask for testing. Measured in Revit 2023: a window in 0.3–1.1 s, Keep is
  one Ctrl+Z (pile; floor + its spot elevation; an exec move), Discard leaves the edit counter as it was.

Added — apilookup: the Revit API of this Revit, for exec

• Plan 16, after pyRevit's lookup_revit_api. apilookup Wall, apilookup Wall.Create,
  apilookup FilteredElementCollector --filter Where: namespace (and the full name to write in exec
  when exec does not import it), how to get one (the collector line goes through a base class for
  Room, ModelLine and the other classes Revit's class filter refuses), properties, methods by overload, enum values and
  [Obsolete] with Revit's own replacement advice — reflected from the RevitAPI of the running year.
  Unknown names give the closest ones. 0.28 s the first time, then 0.01–0.03 s.
• A failed exec compile now appends the matching lookup (Hint: apilookup Wall.Widht … Closest: Wall.Width) — matched by error number, so the Dutch compiler messages work too.

Added — exec stops runaway loops

• Plan 17. An endless loop in an exec snippet froze Revit until it was killed. Every loop body
  written with { } now checks a deadline: after 25 s (?timeout=<s>, up to 300) the snippet stops,
  its transaction is rolled back and exec answers EXEC_TIMEOUT — measured 25.1 s, Revit answered
  the next command at once, no measurable overhead on normal loops. Brace-less loops, recursion and a
  single long Revit call are still not interruptible (the timeout message says so).

Added — quay walls, capstones and curved runs as real families (profile, extrude, sweep, lwall)

• Plan 12 phase 1. A composite cross-section used to be an exec DirectShape: no family or type,
  no Volume in a schedule, join refused. Four commands now generate a real Revit family on the
  fly, load it and place it as ONE undo step (also inside batch, atomic included):
  • lwall x1 y1 x2 y2 --stem 600x4000 --foot 2500x800 [--toe] [--side left|right] [--slope] — an
    L-shaped quay wall on one parametric line-based Generic Model (VM_L-wand, or … SF with
    --category foundation): stem and foot sizes are type parameters on locked reference planes, each
    size combination becomes a type named from its sizes, an existing type is reused. The line is the
    stem's front face, the heel lies left of the line unless --side right.
  • profile <name> --points u,v … — a named section stored as a Revit Profile family (also usable in
    Revit's own Wall Sweep / Slab Edge tools) with its points in VM_Profile; profile <name> prints
    points, area, box and centroid; profile lists them.
  • extrude <profile | --points …> --along <line/wall id | x1 y1 x2 y2> — line-based Generic Model
    (--category foundation = point-based Structural Foundation with Wall length, framing = a beam);
    extrude … --vertical <height> --at <x y> stands a plan profile up (Height is a type parameter).
  • sweep <profile> --along <id,id,…> — along a chain of lines and arcs (any order) or a wall; the
    path is fixed in the family and the response says so.
• Profiles are mm, u = left of the run direction (the side section looks to), v = up; outlines are
  closed, cleaned and checked (a crossing outline names its segments).
• Every generated family schedules by type with a correct Volume and a shared VM_Length (fixed
  GUID, so all of them share one schedule column); Material is a type parameter (--material, or
  the pack's default). The new element is joined with the walls, floors and generated elements it
  overlaps (--no-join to skip; library families such as piles are never joined), gets the office
  phase (--phase), runs the post-command check and is journaled with the .rfa it wrote.
• Re-running updates instead of adding "(2)": the same profile reuses the loaded family, a changed one
  is regenerated and reloaded keeping the project's type values; a family edited by hand in Revit
  since (or one VibeModel did not make) is refused until --replace. Live-checked in Revit 2023
  (docs/verify/plan12-live-2026-10-16.md): a reused family is not opened, so its hand edits show
  up as a WARN when Revit's volume differs from profile area × length; --replace regenerates
  even with unchanged points.
• The .rfa files go to <project folder>\VibeModel\families\ (3 s deadline; offline → a local copy,
  said in the response). Revit's shared-parameter file setting is swapped for the build and always
  restored.
• Office packs get an optional profiles block (prefix, category per kind, templates, folder,
  shared parameters, materials, type-name pattern) and the example pack a kadeconstructie topic
  sheet: the questions an office answers about its quay walls, without values.

Security — the local server only answers the user's own tools

A brainstorm review (2026-10-15) found that any web page the user had open could drive Revit: the
server never looked at Host or Origin, and the token was off unless VIBEMODEL_TOKEN was set —
<img src="http://127.0.0.1:18884/exec?args=…"> ran C# inside Revit, and a domain resolving to
127.0.0.1 could also read readdoc/memory. See the new SECURITY.md.

• Browser requests are refused (403 forbidden, before /health too): any request with an
  Origin header, a Sec-Fetch-Site other than none/same-origin, a cross-site Sec-Fetch-Mode,
  or a Host that is not 127.0.0.1, localhost or [::1] (bare or with the server's own port).
  curl, the chat backends and the Claude Code CLI send none of these — nothing legitimate changes.
• A token on every call, by default. Without VIBEMODEL_TOKEN the server now generates a random
  per-session token and publishes it in the per-user %LOCALAPPDATA%\VibeModel\servers\<port>.json
  (token field). The chat pane reads it in-process, the Claude Code CLI gets it as VIBEMODEL_TOKEN;
  terminal one-liners for bash and PowerShell are in CLAUDE.md/README. An explicit VIBEMODEL_TOKEN
  still wins. "OpenServer": true (managed.json or settings.json) restores the open server for
  scripts; Diagnose shows which mode is active, and a 401's hint names the servers file.
• managed.json must be IT's. %ProgramData%\VibeModel\managed.json is only trusted when file and
  folder are owned by Administrators or SYSTEM and give ordinary users no write access (Windows lets
  users create folders under ProgramData); otherwise it is ignored, logged once and named in Diagnose.
  docs/deployment.md shows the icacls commands.

Fixed

• POST /batch: a multi-byte character (°, m², ë) that straddled a 4 KB read boundary was
  decoded as two broken characters and changed the body's byte count. The request is now read as
  bytes against Content-Length and decoded once; Expect: 100-continue (curl, bodies over 1 KB) is
  answered before the body is awaited.
• scripts/sign.ps1 signed silently without a timestamp when the timestamp server was unreachable
  (such a signature dies with the certificate). It is now an error unless -NoTimestamp is passed.
• poll-health.ps1 and the build summary use 127.0.0.1 instead of localhost (IPv6 stall).

Full Changelog: v1.2.10...v1.2.11

v1.2.10 — Zero-Admin Onboarding, Annotations Survive Replacements

Changed — installing for people who are not programmers (no admin, no terminal)

Feedback from a colleague who installed it: the add-in landed, but "Node.js to connect Claude" was
nowhere to be found. Installing developer tools is not something modellers do, and office laptops
have no administrator rights.

• Connect to Claude, inside Revit. An unconnected chat shows a wizard instead of npm commands:
  paste an API key (checked against the API at once, free: GET /v1/models/{model}; a wrong key is
  never stored), or install Claude Code with Anthropic's per-user installer in a visible window, log
  in, and switch to it — no restart. Every control has an AutomationId.
• An API key wins. auto now prefers a configured key (managed.json, ANTHROPIC_API_KEY, or the
  user's own), then Claude Code, then a local model. Default model claude-sonnet-5-5.
• The user's own key is never plain text on disk: DPAPI-encrypted for the Windows user
  (AnthropicApiKeyProtected); an old plain-text key is encrypted on first read and removed. (A key
  IT puts in managed.json is plain text there by design — protect that file with an ACL.)
• IT can manage it: read-only managed.json (%ProgramData%\VibeModel\ then %APPDATA%\VibeModel\)
  with PreferredBackend, Model, ApiBaseUrl, AnthropicApiKey, DisableClaudeCode, ClaudeCliPath,
  Language; managed fields are locked in Settings ("beheerd door IT"). ApiBaseUrl lets a gateway
  that speaks the Messages API stand in for api.anthropic.com. See docs/deployment.md.
• Office networks: every API call (chat, quick replies, distiller, key test) goes through the
  Windows proxy, authenticating to the proxy with the user's Windows credentials, with TLS 1.2 or
  newer (Revit's process-wide TLS setting is only touched when it pins older versions) and the
  Windows certificate store. Claude Code gets the Windows proxy as HTTPS_PROXY when none is set,
  plus NO_PROXY for 127.0.0.1/localhost so its calls to Revit never go through the proxy.
• Claude Code found where the native installer puts it (%USERPROFILE%\.local\bin) and on a PATH
  read fresh from the registry; ClaudeCliPath / VIBEMODEL_CLAUDE_CLI set it (none = off).
  Without Git for Windows the CLI shells out through PowerShell: it is now allowed, and the prompt
  says to call curl.exe there.
• Diagnose (chat header + diagnose command): versions, signature, backend, key source (masked),
  where Claude Code was looked for, proxy, DNS/HTTPS to api.anthropic.com and claude.ai with the
  certificate issuer, recent warnings/errors, settings with secrets masked; Copy / Save.
• Cost line under each answer: 31.0k tokens · ≈ €0,12 (API: list prices in ModelPricing;
  Claude Code: its own total_cost_usd). Never stored with the chat.
• Settings → Anthropic API: model and endpoint fields; Validate uses the same free key check as the
  wizard, against the endpoint typed in the box (a network failure names that host), and tests IT's /
  the environment's key when the box is empty. Such a key is shown masked and never copied into settings.json. The Claude Code tab finds the
  CLI the way the backend does (off the UI thread) and no longer mentions npm.
• Warnings and errors are always logged now (INFO stays behind VIBEMODEL_DEBUG=1), so support has a log.
• Header: "Niet verbonden" in the pane's language; the buttons stay visible in the default narrow pane.

Fixed — the API backend on models that think by default

• Sonnet 5.5 (the new default) thinks by default. Its thinking blocks are now kept and sent back with
  the turn (they were dropped, which breaks a tool loop), the system prompt is frozen for a whole turn,
  screenshots and attachments are trimmed only between turns — the newest screenshot stays an image
  for follow-up questions — and then stale thinking is removed; a 400 about thinking blocks is
  answered once by removing them and retrying (only when there are any). A refusal and a cut-off
  answer are explained instead of returning nothing. max_tokens 32000.

Installer and release zip

• install.cmd asks nothing but "close Revit" (no API-key prompt any more), is idempotent ("already up
  to date"), logs to %LOCALAPPDATA%\VibeModel\logs\install.log, reports the signature, and has
  -Quiet (IT: no questions; exit 2 when Revit runs, 3 when the build's Revit is missing) and
  -InstallClaudeCode (Anthropic's installer in its own PowerShell).
• Only the Revit the build is for. The zip carries revit-year.txt; the installer installs into that
  Revit year only and names the others it leaves alone. The old script copied the Revit 2023 build into
  every Revit it found, so a laptop with Revit 2025 as well got an add-in 2025 cannot load.
• scripts/sign.ps1 (Set-AuthenticodeSignature + timestamp) and package-release.ps1 -Sign -Thumbprint.
  Measured in Revit 2023: unsigned → one "Always Load" prompt per new version; a trusted signature
  → no prompt at all; a self-signed (untrusted) signature → "Security - Invalid Signature … may have
  been tampered with" on every start, with only Load / Do Not Load. So packaging refuses to sign
  without a real certificate (-AllowSelfSigned for tests only), and the installer does not offer to
  trust a certificate (Windows itself warns that adding a root is a security risk).

Added — annotations survive replacements

• Seen during the demo recordings: the chat put spot elevations on a capstone and a pile tip, then in
  a later turn replaced those elements — the spots silently vanished or broke. Measured in Revit 2023:
  most host changes through the API raise no failure. Deleting a floor deletes its spot and a 3-reference
  dimension; a wall+floor dimension survives with only the wall references (0 segments); a pile's
  parameter change can leave its tip spot with a stale value; shape-editing a floor invalidates its spot.
• Around delete, exec, set, join, unjoin and phase (and any batch with one of them) the
  spot elevations, dimensions and tags on the elements involved are recorded (a type id covers its
  instances) and afterwards re-hosted: refreshed on the same element when it moved or went stale, else
  moved to a replacement — an element of the same category that the command added or VibeModel created
  earlier this session, never an unrelated neighbour (spots: a face/edge at the same height ±1 mm within
  50 mm; dimensions: a face on the old reference plane ±1 mm; tags: the replacement covering the old
  element's middle). An annotation the command deleted itself stays deleted. Whatever cannot be
  re-hosted is deleted, never left invalid. One line says what happened: -- annotations: re-hosted …; removed … (JSON annotations), (Revit) when Revit's failure policy deleted it. Same undo step,
  except exec (its own step). Verified live: piles 320→350 replaced by placeid + delete (both
  pile spots and the floor-pile dimension re-hosted, values unchanged), the floor recreated by exec
  (spot + both dimensions re-created with all references), a pile moved (the spot followed it, no
  line), the floor raised by set (spot follows, no line), the floor shape-edited by exec (warning
  dismissed, spot re-hosted), a spot an exec deleted on purpose (stays deleted, no line), and in a
  section showing levels a floor recreated by exec (its face+level dimension and its tag re-hosted).
• spot <x> <y> | spot <id> top|bottom [--leader x y] [--fixed] [--type name] — a spot elevation
  (peilmaat). It snaps to a face the section cuts, else the edge the view shows, and always to an edge
  of a family instance (Revit refuses instance faces and faces behind the cut). The response says what
  it is attached to and warns when that element is likely to be replaced; --fixed hangs it on a
  detail line that never moves.
• whatdepends <ids|selected> (read-only) — the annotations (per view and sheet), hosted and joined
  elements that depend on elements, with a verdict, before you replace them.
• dimension prefers a level, grid or reference plane at the face's position (±1 mm; the faces
  themselves when Revit refuses that), lists Attached to: per reference and notes when a reference is
  likely to be replaced; JSON references get stable and vibeModelCreated. tag says what it tags; text --leader says its leader is a free
  point.

Fixed — dimensions and spots on family instances hung on the family symbol

• Faces and edges of a family instance's geometry carry references to the family symbol. dimension
  used them as they were, so a dimension to a pile was attached to the symbol: it outlived the pile and
  no scan for the pile found it. Both dimension and spot now use the instance's own reference to
  the same face/edge.

v1.2.9 — Revit Failures Without Dialogs, IFC Read-Back, Readable Installer

Fixed — a Revit failure dialog no longer hangs every command

• Seen live during the demo recordings: a command or exec snippet that made Revit post an error
  ("Spot Dimension does not lie on its reference", "One or more Spot Dimension references are no
  longer valid") or a warning in a transaction without a handler ("Highlighted walls overlap" —
  wall already dismissed warnings, so most likely an exec snippet's own transaction) opened
  Revit's modal failure dialog. It was invisible with Revit minimized or driven headless, the
  request timed out after 30 s, every following command timed out too, and the chat turn ended
  with "Revit hangt in een dialoog".
• VibeModel now handles failures itself while a command runs (RevitFailurePolicy): warnings are
  dismissed and reported (-- revit warning: …). An error whose only failing elements are
  view-specific spot dimensions, dimensions or tags is resolved with Revit's "Delete Element(s)",
  which keeps the change (-- revit resolved: … → deleted 1 annotation: <id> (Spot Elevations)).
  Any other error rolls back and returns ERROR: Revit rolled the change back: <Revit's reason>
  with a Hint: line (join keeps its own refusal report, with that reason in it). When one
  failure forces a rollback, nothing else of that pass is applied. JSON gets an additive revit
  object, also per batch command. This covers VibeModel's own transactions (preprocessor) and
  transactions an exec snippet opens itself (Application.FailuresProcessing, only while a
  command runs — over HTTP or the file-based fallback; your own work in Revit keeps the normal
  dialogs).
• A transaction Revit rolled back during commit is now an error instead of a success (the commit
  status used to be ignored). Live example: set <wall> "Unconnected Height" 1 reported success while
  Revit silently undid it; it now says Revit rolled the change back: Revit gave no reason ….
• Any dialog that still opens during a command is logged with its id.
• A failure Revit keeps re-posting after it was resolved is rolled back after 10 rounds instead of
  looping (FailureLoopGuard); a snippet whose many transactions each resolve a different
  annotation is not mistaken for such a loop.

Fixed — "the IFC has no piles"

• export ifc reads its own file back. The piles were there: Revit 2023's default IFC class
  table (exportlayers-ifc-IAI.txt) maps Structural Foundations to IfcSlab BASESLAB, so 510 piles
  arrived as slabs and a search for IFCPILE/IFCFOOTING found nothing. The response now lists per
  category how many Revit elements went in and as which IFC class, which model elements in scope are
  missing (with the usual causes: a category mapped to Not Exported, Export to IFC = Don't Export,
  the export phase), and names the foundation mapping with the fix (Export Type to IFC As).

Changed — shorter chat answers

• Answers ran to 6–8 lines: a closing list of 2–3 next steps (asked for by two older prompt lines)
  and, in nearly every answer, the reminder that the work view is on the existing phase. The rules
  now count notes, warnings and offers in the 5 lines, allow ONE closing offer line (the quick-reply
  chips turn it into buttons), mention the view's phase only when this turn's work is hidden by it,
  and drop the "converted to m" and "one Ctrl+Z" restatements.

Fixed — installer that could not be read ("I ran install.ps1 and see no tab")

• A colleague downloaded GitHub's Source code (zip) — the only zip on the releases page, since no
  release since v1.2.1 had an add-in zip attached — ran install.ps1, and the window closed on
  the "Cannot find VibeModel.dll" error before it could be read. The installer now stays open at the
  end and after every error, recognizes the source-code zip and names the right download, asks to
  close a running Revit (it keeps the DLL locked), and verifies afterwards that every file is in
  place and unblocked. The API-key prompt says Claude Code users just press Enter, and saving a key
  no longer overwrites the other settings or pins an old model id.
• scripts/package-release.ps1 builds and packs release/VibeModel-v<version>-Revit<year>.zip
  (add-in, PdfText helper, install.cmd/.ps1, README.txt with the three steps) — the asset every
  release gets from now on. README: download that zip under Assets, double-click install.cmd.

Docs

• CLAUDE.md: examples for filter, measure, whereused, zoomto, isolate/unisolate,
  hide/show, colorsplash and chatlog (the only commands without one).
• chatlog gets its step label in both languages; a test now checks every registered command has one.

Demo videos, October 2026 (Dutch)

Seven real screen recordings of the VibeModel chat in Revit 2023 (Dutch prompts and answers, English step cards), made 12-13 October 2026 for the werkvoorbereiders user group. Waiting time is sped up 6x (red badge shows the real seconds); everything else is real time.

1. deel1 – a quay wall as an L-wall from the base-map (BGT) quay line: wall, foundation slab, capstone; two pile rows under the slab; a 1:50 section with level marks.

https://github.com/user-attachments/assets/0265c762-6a13-4089-b537-b8c73ea619e8
https://github.com/user-attachments/assets/f0ce4493-641e-4ac3-a2cd-503215edaa36

2. deel2 – a laser scan (point cloud) over the model; ground level read along the wall every 2 m; the capstone top made to follow it.

DEEL.2.-.deksteen.volgt.puntenwolk.2.vragen.mp4

3. deel3 – expansion joints every 10 m with an annotated elevation; wooden piles replaced by raked concrete piles with pile numbers; a drowning-ladder recessed in the wall.

DEEL.3.-.dilataties.schoorpalen.drenkelingentrap.3.vragen.mp4

4. deel4 – a pile schedule, level marks in the section, everything on an A0 sheet with a fit check, exported to PDF.

DEEL.4.-.palenstaat.peilmaten.A0-blad.3.vragen.mp4

5. deel5 – the model checked against the office standards pack (problems coloured red), BIM-ID fields filled, a temporary sheet-pile cofferdam in the temporary-works phase.

DEEL.5.-.kantoorstandaard.BIM-ID.bouwkuip.3.vragen.mp4

6. deel6 – the project folder (memo, PDF) read with sources, a project memory entry, the journal of today's changes.

DEEL.6.-.projectmap.geheugen.journaal.3.vragen.mp4

7. kort – "why can't I see the capstone?" – the view's settings read and the cause fixed.

KAREN.-.hoeksteen.en.blad.0031.3.vragen.mp4

The README GIFs are time-lapses cut from these files.

v1.2.1 — Source-Data Reading & Seamless Chat Port Isolation

Two features in one release: the AI can now read your imported source data (DWG vectors + point-cloud ground levels) instead of guessing from screenshots, and multi-instance chat no longer breaks when running several Revit windows.

Added

Source-data reading (DWG + point clouds)

Six new read-only commands:

• imports — list CAD imports/links with bbox (mm) + curve/layer counts
• layers <id> — DWG layer names with object counts
• curves <id> <layer> [--bbox] [--closed] [--page] — actual coordinates in mm; --closed chains segments into footprint loops paste-ready for /floor
• pointclouds — loaded .rcp/.rcs instances with bbox (mm)
• pcprobe <id> <x> <y> [r] — height histogram + robust ground estimate at a point
• pcline <id> <x1> <y1> <x2> <y2> [step] — ground profile along a line

Ground estimation picks the lowest dense band of points and averages only its bottom 200mm — parked cars, trees, bins, and facades rising from the street don't skew it. pcline rejects per-station spikes and interpolates occluded stations (flagged interp).

Seamless chat across multiple Revit instances

• Per-port prompt files — a second Revit instance no longer poisons the first one's chat by overwriting the shared system-prompt file (fixes connection-refused chat after opening/closing a second window)
• Self-healing port directive — resumed chat sessions ignore dead ports remembered from earlier history
• Pre-flight health check — a down server yields one plain-language error instead of minutes of failed curl attempts
• Server discovery files — each instance publishes %LOCALAPPDATA%\VibeModel\servers\<port>.json ({port, pid, startedUtc}) so external clients find fallback ports instead of assuming 18884

Build

• Add-in deployment is now opt-in (-p:Deploy=true, passed by build.ps1) — plain dotnet build/dotnet test compile only, so builds never fight Revit over a locked DLL or overwrite the installed add-in

Tests

Headless suite grown to 107 tests (was 61): curve chaining, point-cloud ground analysis, arg parsing, port isolation, discovery JSON.

Install: download the source below and run install.ps1 (see README).