fix(main): embed DOCKER_AGENT_VERSION as build-time constant via tsup define

[docker-agent]

Problem

In the 3-pass release chain, GITHUB_ACTION_PATH is set to the composite sub-action directory (e.g. review-pr/) rather than the action root. The previous runtime code in src/main/index.ts called resolveActionRoot() which returned GITHUB_ACTION_PATH directly, then tried to read DOCKER_AGENT_VERSION from that path:

ENOENT: no such file or directory, open '.../95867eb/review-pr/DOCKER_AGENT_VERSION'

Fix

DOCKER_AGENT_VERSION is a build-time concern, not a runtime file concern. The file is read once during pnpm build and embedded as a compile-time constant (__DOCKER_AGENT_VERSION__) via tsup's define option — exactly the same mechanism as process.env.NODE_ENV replacement in bundlers.

Changes

tsup.config.ts

• Import readFileSync and read DOCKER_AGENT_VERSION at build time
• Add define: { __DOCKER_AGENT_VERSION__: JSON.stringify(version) } so the literal string is inlined into every bundle

vitest.config.ts

• Mirror the same define entry so tests running against TypeScript source (not the bundle) resolve the constant correctly

src/main/index.ts

• Remove resolveActionRoot(), the ACTION_PATH constant, and readDockerAgentVersion()
• Add declare const __DOCKER_AGENT_VERSION__: string (TypeScript ambient declaration for the injected global)
• Replace cagentVersion = readDockerAgentVersion() with cagentVersion = __DOCKER_AGENT_VERSION__

What stays the same

DOCKER_AGENT_VERSION remains the single source of truth: the file is still updated by the update-docker-agent-version.yml workflow and still consumed by bash steps in the composite sub-actions (action.yml, review-pr/action.yml). Only the JS runtime filesystem read is eliminated.

Validation

• pnpm build ✅ — version v1.57.0 is embedded as a literal on line 100565 of dist/main.js; DOCKER_AGENT_VERSION does not appear anywhere in the bundle
• pnpm test ✅ — 306 unit tests pass; integration tests pass including the check that cagent-version output matches the version file
• pnpm lint ✅ — Biome, tsc --noEmit, and actionlint all clean

[docker-agent]

Assessment: 🟢 APPROVE

The PR correctly solves the ENOENT runtime failure by moving the DOCKER_AGENT_VERSION read from runtime filesystem access to a tsup build-time define constant. The approach is idiomatic (same mechanism as process.env.NODE_ENV in bundlers), the TypeScript ambient declaration is properly scoped, and the vitest define mirror ensures test parity with the bundle. No high or medium severity issues found.

Minor observations (no action required):

1. tsup.config.ts and vitest.config.ts — no error handling on readFileSync (low): If DOCKER_AGENT_VERSION is absent (e.g. after git clean -fdx without regenerating), both pnpm build and pnpm test fail with a raw Node.js stack trace rather than a clear diagnostic message. Given this file is committed to the repo and always present, the risk is negligible in practice.

2. src/main/index.ts — no runtime guard for __DOCKER_AGENT_VERSION__ (low): The declare const tells TypeScript the identifier exists, but if the bundle is ever loaded without tsup's substitution applied (e.g. a direct ts-node invocation), a ReferenceError would be thrown. The vitest.config.ts define mirror closes this gap for the official test runner, making this a non-issue for the supported workflows.