v1.2.10 — Zero-Admin Onboarding, Annotations Survive Replacements

Changed — installing for people who are not programmers (no admin, no terminal)

Feedback from a colleague who installed it: the add-in landed, but "Node.js to connect Claude" was
nowhere to be found. Installing developer tools is not something modellers do, and office laptops
have no administrator rights.

• Connect to Claude, inside Revit. An unconnected chat shows a wizard instead of npm commands:
  paste an API key (checked against the API at once, free: GET /v1/models/{model}; a wrong key is
  never stored), or install Claude Code with Anthropic's per-user installer in a visible window, log
  in, and switch to it — no restart. Every control has an AutomationId.
• An API key wins. auto now prefers a configured key (managed.json, ANTHROPIC_API_KEY, or the
  user's own), then Claude Code, then a local model. Default model claude-sonnet-5-5.
• The user's own key is never plain text on disk: DPAPI-encrypted for the Windows user
  (AnthropicApiKeyProtected); an old plain-text key is encrypted on first read and removed. (A key
  IT puts in managed.json is plain text there by design — protect that file with an ACL.)
• IT can manage it: read-only managed.json (%ProgramData%\VibeModel\ then %APPDATA%\VibeModel\)
  with PreferredBackend, Model, ApiBaseUrl, AnthropicApiKey, DisableClaudeCode, ClaudeCliPath,
  Language; managed fields are locked in Settings ("beheerd door IT"). ApiBaseUrl lets a gateway
  that speaks the Messages API stand in for api.anthropic.com. See docs/deployment.md.
• Office networks: every API call (chat, quick replies, distiller, key test) goes through the
  Windows proxy, authenticating to the proxy with the user's Windows credentials, with TLS 1.2 or
  newer (Revit's process-wide TLS setting is only touched when it pins older versions) and the
  Windows certificate store. Claude Code gets the Windows proxy as HTTPS_PROXY when none is set,
  plus NO_PROXY for 127.0.0.1/localhost so its calls to Revit never go through the proxy.
• Claude Code found where the native installer puts it (%USERPROFILE%\.local\bin) and on a PATH
  read fresh from the registry; ClaudeCliPath / VIBEMODEL_CLAUDE_CLI set it (none = off).
  Without Git for Windows the CLI shells out through PowerShell: it is now allowed, and the prompt
  says to call curl.exe there.
• Diagnose (chat header + diagnose command): versions, signature, backend, key source (masked),
  where Claude Code was looked for, proxy, DNS/HTTPS to api.anthropic.com and claude.ai with the
  certificate issuer, recent warnings/errors, settings with secrets masked; Copy / Save.
• Cost line under each answer: 31.0k tokens · ≈ €0,12 (API: list prices in ModelPricing;
  Claude Code: its own total_cost_usd). Never stored with the chat.
• Settings → Anthropic API: model and endpoint fields; Validate uses the same free key check as the
  wizard, against the endpoint typed in the box (a network failure names that host), and tests IT's /
  the environment's key when the box is empty. Such a key is shown masked and never copied into settings.json. The Claude Code tab finds the
  CLI the way the backend does (off the UI thread) and no longer mentions npm.
• Warnings and errors are always logged now (INFO stays behind VIBEMODEL_DEBUG=1), so support has a log.
• Header: "Niet verbonden" in the pane's language; the buttons stay visible in the default narrow pane.

Fixed — the API backend on models that think by default

• Sonnet 5.5 (the new default) thinks by default. Its thinking blocks are now kept and sent back with
  the turn (they were dropped, which breaks a tool loop), the system prompt is frozen for a whole turn,
  screenshots and attachments are trimmed only between turns — the newest screenshot stays an image
  for follow-up questions — and then stale thinking is removed; a 400 about thinking blocks is
  answered once by removing them and retrying (only when there are any). A refusal and a cut-off
  answer are explained instead of returning nothing. max_tokens 32000.

Installer and release zip

• install.cmd asks nothing but "close Revit" (no API-key prompt any more), is idempotent ("already up
  to date"), logs to %LOCALAPPDATA%\VibeModel\logs\install.log, reports the signature, and has
  -Quiet (IT: no questions; exit 2 when Revit runs, 3 when the build's Revit is missing) and
  -InstallClaudeCode (Anthropic's installer in its own PowerShell).
• Only the Revit the build is for. The zip carries revit-year.txt; the installer installs into that
  Revit year only and names the others it leaves alone. The old script copied the Revit 2023 build into
  every Revit it found, so a laptop with Revit 2025 as well got an add-in 2025 cannot load.
• scripts/sign.ps1 (Set-AuthenticodeSignature + timestamp) and package-release.ps1 -Sign -Thumbprint.
  Measured in Revit 2023: unsigned → one "Always Load" prompt per new version; a trusted signature
  → no prompt at all; a self-signed (untrusted) signature → "Security - Invalid Signature … may have
  been tampered with" on every start, with only Load / Do Not Load. So packaging refuses to sign
  without a real certificate (-AllowSelfSigned for tests only), and the installer does not offer to
  trust a certificate (Windows itself warns that adding a root is a security risk).

Added — annotations survive replacements

• Seen during the demo recordings: the chat put spot elevations on a capstone and a pile tip, then in
  a later turn replaced those elements — the spots silently vanished or broke. Measured in Revit 2023:
  most host changes through the API raise no failure. Deleting a floor deletes its spot and a 3-reference
  dimension; a wall+floor dimension survives with only the wall references (0 segments); a pile's
  parameter change can leave its tip spot with a stale value; shape-editing a floor invalidates its spot.
• Around delete, exec, set, join, unjoin and phase (and any batch with one of them) the
  spot elevations, dimensions and tags on the elements involved are recorded (a type id covers its
  instances) and afterwards re-hosted: refreshed on the same element when it moved or went stale, else
  moved to a replacement — an element of the same category that the command added or VibeModel created
  earlier this session, never an unrelated neighbour (spots: a face/edge at the same height ±1 mm within
  50 mm; dimensions: a face on the old reference plane ±1 mm; tags: the replacement covering the old
  element's middle). An annotation the command deleted itself stays deleted. Whatever cannot be
  re-hosted is deleted, never left invalid. One line says what happened: -- annotations: re-hosted …; removed … (JSON annotations), (Revit) when Revit's failure policy deleted it. Same undo step,
  except exec (its own step). Verified live: piles 320→350 replaced by placeid + delete (both
  pile spots and the floor-pile dimension re-hosted, values unchanged), the floor recreated by exec
  (spot + both dimensions re-created with all references), a pile moved (the spot followed it, no
  line), the floor raised by set (spot follows, no line), the floor shape-edited by exec (warning
  dismissed, spot re-hosted), a spot an exec deleted on purpose (stays deleted, no line), and in a
  section showing levels a floor recreated by exec (its face+level dimension and its tag re-hosted).
• spot <x> <y> | spot <id> top|bottom [--leader x y] [--fixed] [--type name] — a spot elevation
  (peilmaat). It snaps to a face the section cuts, else the edge the view shows, and always to an edge
  of a family instance (Revit refuses instance faces and faces behind the cut). The response says what
  it is attached to and warns when that element is likely to be replaced; --fixed hangs it on a
  detail line that never moves.
• whatdepends <ids|selected> (read-only) — the annotations (per view and sheet), hosted and joined
  elements that depend on elements, with a verdict, before you replace them.
• dimension prefers a level, grid or reference plane at the face's position (±1 mm; the faces
  themselves when Revit refuses that), lists Attached to: per reference and notes when a reference is
  likely to be replaced; JSON references get stable and vibeModelCreated. tag says what it tags; text --leader says its leader is a free
  point.

Fixed — dimensions and spots on family instances hung on the family symbol

• Faces and edges of a family instance's geometry carry references to the family symbol. dimension
  used them as they were, so a dimension to a pile was attached to the symbol: it outlived the pile and
  no scan for the pile found it. Both dimension and spot now use the instance's own reference to
  the same face/edge.