diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a25f09a87e..17f689c7e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,9 +18,9 @@ jobs:
         node: [24, 26]
     name: node ${{ matrix.node }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
 
@@ -33,21 +33,27 @@ jobs:
       - name: Constraints
         run: yarn constraints
 
-      - name: Lint
-        run: yarn lint
-
+      # Before lint: the type-aware ESLint config resolves vendor packages via
+      # their built declarations (tsconfig.typecheck.json -> vendor/*/lib),
+      # which `yarn typecheck` emits. Lint on a fresh checkout would otherwise
+      # see unresolved types and erupt with no-unsafe-* errors.
       - name: Typecheck (src + tests + examples)
         run: yarn typecheck
 
+      - name: Lint
+        run: yarn lint
+
       - name: Tests with coverage gate (per-file 100%)
         run: yarn test:coverage
 
+      # Before hygiene: publint validates the packed artifacts (lib/index.js),
+      # which only the tsdown bundling step emits.
+      - name: Build (tsc -b + tsdown bundles)
+        run: yarn build
+
       - name: Hygiene (knip + publint)
         run: yarn knip && yarn publint
 
-      - name: Build (tsc -b + dumble bundles)
-        run: yarn build
-
       - name: Demo smoke test
         run: |
           set -euo pipefail
diff --git a/AGENTS.md b/AGENTS.md
index fe118f7461..4df48812fc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -50,7 +50,11 @@ yarn demo           # run examples/echo-agent (needs --expose-internals, the
 
 Dev/test/demo run **unbuilt** via tsx + the `paths` map in the root
 `tsconfig.json` (`vitest` resolves through `tsconfig.test.json`). Building is
-only needed for publishing/consumption outside the repo.
+only needed for publishing/consumption outside the repo — with one exception:
+`yarn lint`'s type-aware rules resolve vendor packages through their built
+declarations (`tsconfig.typecheck.json` → `vendor/*/lib`), so run
+`yarn typecheck` once after a fresh clone (CI does the same) or lint reports
+unresolved-type `no-unsafe-*` errors.
 
 ## Conventions
 
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 68f8b050d9..ef29d9ffbe 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -18,6 +18,28 @@
     "noFallthroughCasesInSwitch": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
-    "types": ["node"]
+    "types": ["node"],
+    // Source-level resolution for the build graph: without this, a fresh
+    // checkout's first `tsc -b` resolves sibling vendor plugins through their
+    // package.json types (vendor/*/lib/*.d.ts) which don't exist yet — TS2307
+    // until a second run. Derived configs that want lib resolution
+    // (tsconfig.typecheck.json) override this map wholesale.
+    "paths": {
+      "cordis": ["./vendor/cordis/src"],
+      "cosmokit": ["./vendor/cosmokit/src"],
+      "schemastery": ["./vendor/schemastery/src"],
+      "@cordisjs/plugin-loader": ["./vendor/loader/src"],
+      "@cordisjs/plugin-include": ["./vendor/include/src"],
+      "@cordisjs/plugin-group": ["./vendor/group/src"],
+      "@cordisjs/plugin-timer": ["./vendor/timer/src"],
+      "@cordisjs/plugin-hmr": ["./vendor/hmr/src"],
+      "@cordisjs/plugin-logger-console": ["./vendor/logger-console/src"],
+      "@deepseek-ai/dsh-llm": ["./packages/llm/src"],
+      "@deepseek-ai/dsh-session": ["./packages/session/src"],
+      "@deepseek-ai/dsh-system-prompt": ["./packages/system-prompt/src"],
+      "@deepseek-ai/dsh-tools": ["./packages/tools/src"],
+      "@deepseek-ai/dsh-agent": ["./packages/agent/src"],
+      "@deepseek-ai/dsh-agent-loop": ["./packages/agent-loop/src"]
+    }
   }
 }
diff --git a/tsconfig.json b/tsconfig.json
index 98fe14aaea..725f31659f 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -1,23 +1,4 @@
 {
   "extends": "./tsconfig.base.json",
-  "compilerOptions": {
-    "paths": {
-      "cordis": ["./vendor/cordis/src"],
-      "cosmokit": ["./vendor/cosmokit/src"],
-      "schemastery": ["./vendor/schemastery/src"],
-      "@cordisjs/plugin-loader": ["./vendor/loader/src"],
-      "@cordisjs/plugin-include": ["./vendor/include/src"],
-      "@cordisjs/plugin-group": ["./vendor/group/src"],
-      "@cordisjs/plugin-timer": ["./vendor/timer/src"],
-      "@cordisjs/plugin-hmr": ["./vendor/hmr/src"],
-      "@cordisjs/plugin-logger-console": ["./vendor/logger-console/src"],
-      "@deepseek-ai/dsh-llm": ["./packages/llm/src"],
-      "@deepseek-ai/dsh-session": ["./packages/session/src"],
-      "@deepseek-ai/dsh-system-prompt": ["./packages/system-prompt/src"],
-      "@deepseek-ai/dsh-tools": ["./packages/tools/src"],
-      "@deepseek-ai/dsh-agent": ["./packages/agent/src"],
-      "@deepseek-ai/dsh-agent-loop": ["./packages/agent-loop/src"]
-    }
-  },
   "files": []
 }