fix: install tqdm, which the pinned engine imports but does not require

[Svilen-Stefanov]

Every CodeBoarding run is currently failing, on @v1 and @v2, with:

File ".../codeboarding_cli/commands/full_analysis.py", line 5, in <module>
    from tqdm import tqdm
ModuleNotFoundError: No module named 'tqdm'

Why now, when nothing here changed

1. The pinned CLI imports tqdm in codeboarding_cli/commands/full_analysis.py, which main.py imports unconditionally — so nothing runs, not just full analyses.
2. tqdm is not a declared dependency of codeboarding.
3. It only ever arrived transitively, through openai.
4. openai 3.3.0 dropped tqdm from its requirements.

Pinning codeboarding==0.13.8 pins the release, not what its dependencies resolve to, so the same install line started producing a CLI that cannot start.

Verified rather than inferred: a venv resolved a few hours before the breakage has openai 3.1.0, whose metadata still lists tqdm, and the CLI runs. A fresh resolve today gives openai 3.3.0 and no tqdm:

openai -> 3.3.0
tqdm   -> (ABSENT)

What this does

Names tqdm in the install. That is a workaround for a packaging gap in the engine, commented as such, and should be removed once codeboarding declares its own dependency — the real fix belongs upstream, in the engine's pyproject.toml.

It also checks the CLI can start, so a missing dependency fails at the install step with a stated reason instead of surfacing as a traceback part way into an analysis, after the progress comment has been posted.

That check runs the console script, not python -c 'import main'. python -c puts the current directory on sys.path, and the current directory is the workspace, so any analyzed repository with its own main.py would shadow the CLI's. Confirmed both ways against a stray main.py: python -c 'import main' imported the local file, the console script did not.

Follow-up worth considering

This will recur. The action pins one package but installs an unpinned transitive graph, so any dependency of a dependency can break every consumer overnight. A constraints file, or pip install --require-hashes against a lock, would make the install reproducible. Out of scope here — this PR is the unblock.

🤖 Generated with Claude Code

[codeboarding-review]

CodeBoarding review

Status: 0 changed components

See the full change in CodeBoarding.

graph LR
    n_Visual_Rendering_Engine["Visual Rendering Engine"]
    n_Structural_Diff_Engine["Structural Diff Engine"]
    n_Interaction_Orchestrator["Interaction Orchestrator"]
    n_Visual_Rendering_Engine -- "Returns rendering metadata and diagram artifacts" --> n_Interaction_Orchestrator
    n_Structural_Diff_Engine -- "Provides annotated diff model for visualization" --> n_Visual_Rendering_Engine
    n_Interaction_Orchestrator -- "Triggers structural comparison via CLI" --> n_Structural_Diff_Engine
    classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
    classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
    classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;

Loading

_{download artifacts · run 32188862447}