v2.66.1 - Astro scripts, register() loaders, audit base node_modules

Patch release with bug fixes for the Astro extractor, the node:module register() loader hook, fallow audit base-side worktrees, and tsconfig fallback when an extends chain is broken. Also a small cosmetic pass that swaps em-dashes for ASCII punctuation in user-facing CLI output.

Fixes

• Astro <script src="..."> and inline <script> ESM imports are followed. Astro pages route per-component client code through external <script src="../scripts/foo.ts"> references and inline <script>import '../scripts/bar';</script> ESM bodies; both are bundled into the build output but were surfacing as unused-file. The extractor now scans the post-frontmatter template body for external script and link references and parses inline <script> bodies as TypeScript. Astro only processes a <script> tag when it has zero attributes or only src=, so attributed inline scripts (e.g. is:inline) render as authored without bundling and are intentionally excluded from the import graph to match Astro's own behavior. Thanks @zaphir for the report. (Closes #295)
• node:module register() loader specifiers credit their target packages. register('@swc-node/register/esm', pathToFileURL('./')) from node:module (or the bare module builtin) loads a loader by string specifier rather than via a static or dynamic import, so registered packages like @swc-node/register and tsx were surfacing as unused-dependency. Named imports, aliased named imports, and namespace imports (import * as Module from 'node:module'; Module.register(...)) all engage; same-named functions from any other source are skipped. Thanks @ChrisJr404 for the patch and @pdeveltere for the report. (Closes #293)
• fallow audit base-side worktrees see the same node_modules as HEAD. Audit base worktrees lacked node_modules, breaking tsconfig extends chains that point into installed packages and disabling path-alias resolution on the BASE side. The result was spurious Broken tsconfig chain warnings and false-positive attributions on React Native repos whose tsconfig extends ./node_modules/@react-native/typescript-config/tsconfig.json. Fresh, reusable, and ready persistent base worktrees now symlink repo_root/node_modules so the BASE-side analysis sees the same dependency context as HEAD. The audit base snapshot cache version is bumped so prior snapshots captured under the broken behavior are invalidated. Thanks @iarmankhan for the report. (Closes #292)
• Local tsconfig paths, baseUrl, and rootDirs stay usable when an extends chain is broken. When a tsconfig's extends target was missing or unparsable, the resolver previously fell back to a no-aliases mode for the entire config, so valid local imports against paths defined in the same tsconfig surfaced as unresolved-import. The graph resolver now keeps the local tsconfig's alias contract alive and only drops the broken-extends parent's contributions, so React Native and Expo projects whose framework base tsconfig is untracked or out of sync continue to resolve their own aliases. Audit base snapshots also compare against the same merged config contract as the current run. Thanks @M-Hassan-Raza for the patch. (#299)
• Combined-mode --format json outside a git repository is now exactly one JSON document. When the project root sat outside any git checkout, the hotspot pipeline emitted a structured error blob to stdout and combined mode then appended its normal report on top, so fallow --format json | jq . failed with trailing characters at line 6 column 1. Missing git history is now treated as unavailable hotspot data: stdout stays a single document with empty hotspots, a non-fatal note: hotspot analysis skipped: no git repository found at project root goes to stderr (suppressed by --quiet). Standalone fallow health --hotspots --format json outside a git repo now exits 0 with empty hotspot fields instead of exiting 2 with a JSON error. Thanks @ChrisJr404 for the patch. (Closes #294)

Cosmetic

• User-facing CLI output uses ASCII punctuation in place of em-dashes. Rule descriptions in fallow explain, the top-level fallow --help about line, fallow list boundary output, the JSON actions note for refactor-together clone groups, the markdown health metric legend, hotspot stderr notes, the LSP test-only-dep diagnostic, the MCP list_boundaries tool description, and a handful of lower-traffic strings are now em-dash-free. Internal asserts, code comments, and clippy #[expect] reasons are out of scope.

Full Changelog: v2.66.0...v2.66.1