Fix CI: order steps by artifact dependency, resolve fresh-clone builds

CI failed at Lint with 1519 no-unsafe-* errors on every cross-package
import. Three fresh-checkout issues, invisible locally because lib/
persists between runs:

- Lint ran before Typecheck, but the type-aware ESLint config resolves
  vendor packages via their built declarations (tsconfig.typecheck.json
  -> vendor/*/lib), which Typecheck emits. Reordered.
- The first-ever tsc -b resolved sibling vendor plugins through their
  package.json types (lib/index.d.ts, not yet emitted) — TS2307 until a
  second run. The source-level paths map moves from the root
  tsconfig.json (dev-only, not inherited by package builds) into
  tsconfig.base.json so the whole build graph resolves source-first;
  tsconfig.typecheck.json still overrides wholesale to lib resolution.
- Hygiene ran publint (validates packed lib/index.js bundles) before
  Build emitted them. Reordered.

Also: checkout/setup-node bumped v4 -> v6 (node20 runners are
force-switched to node24 on 2026-06-16), the Build step name catches up
with tsdown, and AGENTS.md documents the one case where a fresh clone
needs `yarn typecheck` before `yarn lint`.

.github/workflows/ci.yml

@@ -18,9 +18,9 @@ jobs:
         node: [24, 26]
     name: node ${{ matrix.node }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
 
@@ -33,21 +33,27 @@ jobs:
       - name: Constraints
         run: yarn constraints
 
-      - name: Lint
-        run: yarn lint
-
+      # Before lint: the type-aware ESLint config resolves vendor packages via
+      # their built declarations (tsconfig.typecheck.json -> vendor/*/lib),
+      # which `yarn typecheck` emits. Lint on a fresh checkout would otherwise
+      # see unresolved types and erupt with no-unsafe-* errors.
       - name: Typecheck (src + tests + examples)
         run: yarn typecheck
 
+      - name: Lint
+        run: yarn lint
+
       - name: Tests with coverage gate (per-file 100%)
         run: yarn test:coverage
 
+      # Before hygiene: publint validates the packed artifacts (lib/index.js),
+      # which only the tsdown bundling step emits.
+      - name: Build (tsc -b + tsdown bundles)
+        run: yarn build
+
       - name: Hygiene (knip + publint)
         run: yarn knip && yarn publint
 
-      - name: Build (tsc -b + dumble bundles)
-        run: yarn build
-
       - name: Demo smoke test
         run: |
           set -euo pipefail

AGENTS.md

@@ -50,7 +50,11 @@ yarn demo           # run examples/echo-agent (needs --expose-internals, the
 
 Dev/test/demo run **unbuilt** via tsx + the `paths` map in the root
 `tsconfig.json` (`vitest` resolves through `tsconfig.test.json`). Building is
-only needed for publishing/consumption outside the repo.
+only needed for publishing/consumption outside the repo — with one exception:
+`yarn lint`'s type-aware rules resolve vendor packages through their built
+declarations (`tsconfig.typecheck.json` → `vendor/*/lib`), so run
+`yarn typecheck` once after a fresh clone (CI does the same) or lint reports
+unresolved-type `no-unsafe-*` errors.
 
 ## Conventions
 

tsconfig.base.json

@@ -18,6 +18,28 @@
     "noFallthroughCasesInSwitch": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
-    "types": ["node"]
+    "types": ["node"],
+    // Source-level resolution for the build graph: without this, a fresh
+    // checkout's first `tsc -b` resolves sibling vendor plugins through their
+    // package.json types (vendor/*/lib/*.d.ts) which don't exist yet — TS2307
+    // until a second run. Derived configs that want lib resolution
+    // (tsconfig.typecheck.json) override this map wholesale.
+    "paths": {
+      "cordis": ["./vendor/cordis/src"],
+      "cosmokit": ["./vendor/cosmokit/src"],
+      "schemastery": ["./vendor/schemastery/src"],
+      "@cordisjs/plugin-loader": ["./vendor/loader/src"],
+      "@cordisjs/plugin-include": ["./vendor/include/src"],
+      "@cordisjs/plugin-group": ["./vendor/group/src"],
+      "@cordisjs/plugin-timer": ["./vendor/timer/src"],
+      "@cordisjs/plugin-hmr": ["./vendor/hmr/src"],
+      "@cordisjs/plugin-logger-console": ["./vendor/logger-console/src"],
+      "@deepseek-ai/dsh-llm": ["./packages/llm/src"],
+      "@deepseek-ai/dsh-session": ["./packages/session/src"],
+      "@deepseek-ai/dsh-system-prompt": ["./packages/system-prompt/src"],
+      "@deepseek-ai/dsh-tools": ["./packages/tools/src"],
+      "@deepseek-ai/dsh-agent": ["./packages/agent/src"],
+      "@deepseek-ai/dsh-agent-loop": ["./packages/agent-loop/src"]
+    }
   }
 }

tsconfig.json

@@ -1,23 +1,4 @@
 {
   "extends": "./tsconfig.base.json",
-  "compilerOptions": {
-    "paths": {
-      "cordis": ["./vendor/cordis/src"],
-      "cosmokit": ["./vendor/cosmokit/src"],
-      "schemastery": ["./vendor/schemastery/src"],
-      "@cordisjs/plugin-loader": ["./vendor/loader/src"],
-      "@cordisjs/plugin-include": ["./vendor/include/src"],
-      "@cordisjs/plugin-group": ["./vendor/group/src"],
-      "@cordisjs/plugin-timer": ["./vendor/timer/src"],
-      "@cordisjs/plugin-hmr": ["./vendor/hmr/src"],
-      "@cordisjs/plugin-logger-console": ["./vendor/logger-console/src"],
-      "@deepseek-ai/dsh-llm": ["./packages/llm/src"],
-      "@deepseek-ai/dsh-session": ["./packages/session/src"],
-      "@deepseek-ai/dsh-system-prompt": ["./packages/system-prompt/src"],
-      "@deepseek-ai/dsh-tools": ["./packages/tools/src"],
-      "@deepseek-ai/dsh-agent": ["./packages/agent/src"],
-      "@deepseek-ai/dsh-agent-loop": ["./packages/agent-loop/src"]
-    }
-  },
   "files": []
 }