[cramforce]

The hot-shots package is a StatsD client that scriptc compiles from its JavaScript. Constructing a client failed. This change closes each gap on the package's UDP path generically. It adds the package as an npm test case whose program sends metrics to a local dgram server.

Gaps and fixes

• Sloppy-mode arguments. The client's constructor and its increment and decrement methods read arguments.length in functions that have named parameters and are not in an ES module. Such a function may now read arguments wherever the aliasing of its parameters cannot show: it reads only arguments.length, or it reads elements and never writes a parameter or an element (argumentsAliasingUnobservable in arguments-usage.ts).
• Function values in an any slot. Client.prototype.timer = function (...) through an untyped Client was refused, because the function has optional parameters. An any slot boxes the function: the box fills omitted arguments with undefined and checks the others, so the slot now admits any signature that can be boxed.
• JSDoc on prototype methods. In a JavaScript file that TypeScript does not check, a prototype method (C.prototype.m = function (...) {}) now takes its documented parameters as checked-dynamic values, as constructors already did. hot-shots documents sendStat(..., sampleRate {Number}, tags {Array}), then passes undefined and objects to those parameters.
• dgram sends from JavaScript. In JavaScript, socket.send() now runs the offset/length form with a sixth argument, completion callbacks, buffer lists (sent as one datagram), and sends on a connected socket. A callback receives (null, bytes), or the send failure instead of an 'error' event. The ladder takes six untyped slots and no longer needs a fence.
• A dgram socket as an untyped value. hot-shots reads socket.emit.bind(socket) and the socket's other listener methods as values. A socket can now cross into the checked-dynamic tree as a handle (SCR_DYNH_DGRAM_SOCKET). The handle wraps an entry that holds the socket's untyped listeners, and its methods are function values that dispatch on their receiver. The handle supports on, once, removeListener, emit, send, close, bind, connect, address, ref and unref. Untyped listeners survive the socket's 'close', as Node keeps them, so the send-after-close error that hot-shots emits still reaches the listener its close() installed. JavaScript listeners with untyped parameters register through the same handle. The code is a runtime unit of its own (scr_dgram_dyn.c, the dgramDyn feature), which links only when a program converts a socket to or from an untyped value. Function.prototype.bind/call/apply on such a method value run at run time.
• String.prototype.concat on strings, which builds the DD_ENTITY_ID tag.
• parseInt over a possibly missing or untyped value in JavaScript, as in parseInt(process.env.DD_DOGSTATSD_PORT, 10) || 8125.

Some paths stay explicit refusals where they run: the TCP transport (socket.emit on a net.Socket), the telegraf message rewrite, and the buffered mode's Timeout handle. The Unix-socket mode reports the missing unix-dgram addon as Node does.

Evidence

• Corpus programs 6590–6596 match Node in the plain and sanitized lanes. They cover sloppy arguments, function values in an any slot, dgram send callbacks, bound socket methods, JSDoc on prototype methods, String.prototype.concat, and parseInt over a missing value.
• tests/fixtures/npm/cases/hot-shots-udp vendors hot-shots 8.5.0. The case compares stdout, stderr and exit status with Node in both lanes. It covers tags, explicit sample rates, the send callback, child clients, the error handler, close, a send after close, mock mode, and the Unix-socket refusal.
• Zero-cost gate against the base commit (--corpus=all, 3450 programs): 3449 byte-identical, including every benchmark and the self-hosted compiler. One program, 2597-dgram-send-ladders.cjs, differs by intent: it is the JavaScript send-ladder program, and its calls now go to the six-slot callback-capable ladder (binary −0.03%). Benchmark time is within tolerance (geomean +0.02%). That run also showed the self-hosted compiler compiling 3.5 times slower: the dgramDyn detection walked every class's fields for each dynamic conversion. After the detection became a once-per-module fixpoint, the self set compiles to identical artifacts at +0.68% compile time (3 pairs, 95% CI −0.36% to +1.94%).

Overlap

#1324 (sloppy arguments) covers the first gap with its own implementation. Whichever of the two lands first, the other should drop its copy. A program that closes the client with promisify(client.close.bind(client))(), where the package's types resolve to any, also needs #1502 (untyped util.promisify).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scriptc	Ready	Preview, v0	Oct 21, 2026 2:23am UTC