fix: 修复临时脚本线程泄漏（OOM 根因）并升级版本至 2.10.55

- TempGroovyScriptContext 改用共享 daemon 调度线程，根治每脚本 new Timer() 的原生线程泄漏
- 覆盖/删除/清空/cache-miss 时 cancel 定时任务，ConcurrentHashMap 防并发
- 修正绝对到期时间戳误传为相对延迟的清理 bug（原实现约 55 年后才触发，自动清理从未生效）
- 原子化 remove(key, value) 防止过期任务误删被刷新脚本
- 新增回归测试 TempGroovyScriptContextTest（线程数不增长 + 到期自动清理）
- 版本号 2.10.54 → 2.10.55（全部 pom + CLAUDE.md）

Co-Authored-By: Claude <noreply@anthropic.com>

Author: xlorne

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## 项目概览
 
-`com.codingapi.springboot:springboot-parent`（v2.10.54）是一套基于 Spring Boot 2.7.18 + JDK 8 的**领域驱动设计（DDD）落地框架**，围绕"事件风暴 + 流程编排 + 数据权限 + 动态脚本"四大支柱提供可插拔的 starter 模块。框架代码本身即是规范，业务方按需引入 starter 即可获得对应能力，无需重复造轮子。
+`com.codingapi.springboot:springboot-parent`（v2.10.55）是一套基于 Spring Boot 2.7.18 + JDK 8 的**领域驱动设计（DDD）落地框架**，围绕"事件风暴 + 流程编排 + 数据权限 + 动态脚本"四大支柱提供可插拔的 starter 模块。框架代码本身即是规范，业务方按需引入 starter 即可获得对应能力，无需重复造轮子。
 
 详细能力文档见 `docs/capabilities/index.md`（共 9 篇），开发规范见 `docs/conventions/index.md`。
 

pom.xml

@@ -15,7 +15,7 @@
 
     <groupId>com.codingapi.springboot</groupId>
     <artifactId>springboot-parent</artifactId>
-    <version>2.10.54</version>
+    <version>2.10.55</version>
 
     <url>https://github.com/codingapi/springboot-framewrok</url>
     <name>springboot-parent</name>

springboot-starter-data-authorization/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <artifactId>springboot-parent</artifactId>
         <groupId>com.codingapi.springboot</groupId>
-        <version>2.10.54</version>
+        <version>2.10.55</version>
     </parent>
 
     <name>springboot-starter-data-authorization</name>

springboot-starter-data-fast/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <artifactId>springboot-parent</artifactId>
         <groupId>com.codingapi.springboot</groupId>
-        <version>2.10.54</version>
+        <version>2.10.55</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

springboot-starter-flow/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <artifactId>springboot-parent</artifactId>
         <groupId>com.codingapi.springboot</groupId>
-        <version>2.10.54</version>
+        <version>2.10.55</version>
     </parent>
 
     <name>springboot-starter-flow</name>

springboot-starter-script/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.codingapi.springboot</groupId>
         <artifactId>springboot-parent</artifactId>
-        <version>2.10.54</version>
+        <version>2.10.55</version>
     </parent>
 
     <name>springboot-starter-script</name>

springboot-starter-script/src/main/java/com/codingapi/springboot/script/temp/TempGroovyScriptContext.java

@@ -5,7 +5,13 @@
 import com.codingapi.springboot.script.repository.TempGroovyScriptRepositoryContext;
 import lombok.Getter;
 
-import java.util.*;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.ScheduledFuture;
+import java.util.concurrent.TimeUnit;
 import java.util.stream.Collectors;
 
 /**
@@ -16,41 +22,58 @@ public class TempGroovyScriptContext {
     @Getter
     private final static TempGroovyScriptContext instance = new TempGroovyScriptContext();
 
+    /**
+     * 共享的清理调度线程（daemon）
+     * 所有临时脚本共用一个调度线程，避免每个脚本创建原生线程导致线程泄漏
+     */
+    private final static ScheduledExecutorService SCHEDULER = Executors.newSingleThreadScheduledExecutor(r -> {
+        Thread thread = new Thread(r, "temp-groovy-script-clear");
+        thread.setDaemon(true);
+        return thread;
+    });
+
     private final Map<String, ClearJob> cache;
 
     private TempGroovyScriptContext() {
-        this.cache = new HashMap<>();
+        this.cache = new ConcurrentHashMap<>();
     }
 
     private static class ClearJob {
 
         @Getter
         private final TempGroovyScript tempGroovyScript;
 
-        private final Timer timer;
+        private final ScheduledFuture<?> future;
 
         public ClearJob(TempGroovyScript groovyScript) {
             this.tempGroovyScript = groovyScript;
-            this.timer = new Timer();
-            this.initTimer();
+            // clearTime 为绝对到期时间戳，需换算为相对延迟
+            long delay = groovyScript.getClearTime() - System.currentTimeMillis();
+            this.future = SCHEDULER.schedule(this::expire, delay, TimeUnit.MILLISECONDS);
         }
 
         public GroovyScript getGroovyScript() {
             return this.tempGroovyScript.getGroovyScript();
         }
 
-        private void initTimer() {
-            this.timer.schedule(new TimerTask() {
-                @Override
-                public void run() {
-                    TempGroovyScriptContext.getInstance().remove(getKey());
-                }
-            }, tempGroovyScript.getClearTime());
-        }
-
         public String getKey() {
             return tempGroovyScript.getKey();
         }
+
+        /**
+         * 到期清理
+         * 仅当缓存中仍是当前任务时才删除，避免过期任务误删已被刷新的脚本
+         */
+        private void expire() {
+            TempGroovyScriptContext.getInstance().removeIfCurrent(getKey(), this);
+        }
+
+        /**
+         * 取消定时清理任务
+         */
+        private void cancel() {
+            this.future.cancel(false);
+        }
     }
 
     /**
@@ -61,7 +84,17 @@ public String getKey() {
     public void save(GroovyScript script) {
         if (script != null) {
             long tempValidTime =  PropertiesContext.getInstance().getTempValidTime();
-            this.cache.put(script.getKey(), new ClearJob(new TempGroovyScript(script, tempValidTime + System.currentTimeMillis())));
+            this.put(script.getKey(), new ClearJob(new TempGroovyScript(script, tempValidTime + System.currentTimeMillis())));
+        }
+    }
+
+    /**
+     * 写入缓存，覆盖时取消旧任务的定时清理
+     */
+    private void put(String key, ClearJob job) {
+        ClearJob previous = this.cache.put(key, job);
+        if (previous != null) {
+            previous.cancel();
         }
     }
 
@@ -74,7 +107,7 @@ public void loadAll(List<TempGroovyScript> groovyScripts) {
                 if (groovyScript.isExpired()) {
                     this.remove(groovyScript.getKey());
                 } else {
-                    this.cache.put(groovyScript.getKey(), new ClearJob(groovyScript));
+                    this.put(groovyScript.getKey(), new ClearJob(groovyScript));
                 }
             }
         }
@@ -94,10 +127,23 @@ public List<TempGroovyScript> findAll() {
      * @param key 脚本key
      */
     public void remove(String key) {
-        this.cache.remove(key);
+        ClearJob job = this.cache.remove(key);
+        if (job != null) {
+            job.cancel();
+        }
         TempGroovyScriptRepositoryContext.getInstance().delete(key);
     }
 
+    /**
+     * 仅当缓存中的任务仍为当前任务时删除，防止过期任务误删已被刷新的脚本。
+     * 使用 ConcurrentHashMap.remove(key, value) 原子判断 + 删除，避免 check-then-act 竞态
+     */
+    private void removeIfCurrent(String key, ClearJob job) {
+        if (this.cache.remove(key, job)) {
+            job.cancel();
+            TempGroovyScriptRepositoryContext.getInstance().delete(key);
+        }
+    }
 
     /**
      * 脚本总数量
@@ -119,7 +165,11 @@ public GroovyScript getGroovyScript(String key) {
         if (job == null) {
             TempGroovyScript groovyScript = TempGroovyScriptRepositoryContext.getInstance().get(key);
             if (groovyScript != null) {
-                this.cache.put(key, new ClearJob(groovyScript));
+                if (groovyScript.isExpired()) {
+                    this.remove(key);
+                    return null;
+                }
+                this.put(key, new ClearJob(groovyScript));
                 return groovyScript.getGroovyScript();
             }
             return null;
@@ -132,6 +182,9 @@ public GroovyScript getGroovyScript(String key) {
      * 清空脚本数据
      */
     public void clear() {
+        for (ClearJob job : this.cache.values()) {
+            job.cancel();
+        }
         this.cache.clear();
     }
-}
+}

springboot-starter-script/src/test/java/com/codingapi/springboot/script/temp/TempGroovyScriptContextTest.java

@@ -0,0 +1,84 @@
+package com.codingapi.springboot.script.temp;
+
+import com.codingapi.springboot.script.GroovyScript;
+import com.codingapi.springboot.script.properties.GroovyScriptProperties;
+import com.codingapi.springboot.script.properties.PropertiesContext;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * 回归测试：临时脚本不得为每个脚本创建原生线程（OOM 根因），
+ * 且脚本到期后应被自动清理。
+ */
+class TempGroovyScriptContextTest {
+
+    private TempGroovyScriptContext context;
+
+    @BeforeEach
+    void setUp() {
+        context = TempGroovyScriptContext.getInstance();
+        // 清理上一用例残留的定时任务
+        context.clear();
+        // 预热共享调度线程，避免首个任务创建线程影响基线统计
+        context.save(script("__warmup__"));
+        context.remove("__warmup__");
+    }
+
+    @AfterEach
+    void tearDown() {
+        // 清理定时任务并恢复默认配置，避免泄漏到同 JVM 的其他测试
+        context.clear();
+        PropertiesContext.getInstance().setProperties(new GroovyScriptProperties());
+    }
+
+    private GroovyScript script(String key) {
+        return GroovyScript.builder(key).script("return 1;").build();
+    }
+
+    @Test
+    void saveManyScriptsShouldNotCreateThreads() {
+        int threadsBefore = Thread.getAllStackTraces().size();
+
+        for (int i = 0; i < 200; i++) {
+            context.save(script("key-" + i));
+        }
+
+        assertEquals(200, context.count());
+        assertEquals(threadsBefore, Thread.getAllStackTraces().size(),
+                "注册 200 个临时脚本不应创建任何新线程");
+    }
+
+    @Test
+    void overwriteRemoveClearShouldNotCreateThreads() {
+        int threadsBefore = Thread.getAllStackTraces().size();
+
+        for (int i = 0; i < 100; i++) {
+            context.save(script("key-" + i));
+            context.save(script("key-" + i)); // 覆盖刷新
+        }
+        for (int i = 0; i < 100; i++) {
+            context.remove("key-" + i);
+        }
+        context.clear();
+
+        assertEquals(0, context.count());
+        assertEquals(threadsBefore, Thread.getAllStackTraces().size(),
+                "覆盖/删除/清空不应创建新线程");
+    }
+
+    @Test
+    void expiredScriptShouldBeRemovedAutomatically() throws InterruptedException {
+        GroovyScriptProperties properties = new GroovyScriptProperties();
+        properties.setTempValidTime(300);
+        PropertiesContext.getInstance().setProperties(properties);
+
+        context.save(script("expire-key"));
+        assertEquals(1, context.count());
+
+        Thread.sleep(1500);
+        assertEquals(0, context.count(), "脚本到期后应被自动清理");
+    }
+}

springboot-starter-security/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>com.codingapi.springboot</groupId>
         <artifactId>springboot-parent</artifactId>
-        <version>2.10.54</version>
+        <version>2.10.55</version>
     </parent>
 
     <artifactId>springboot-starter-security</artifactId>

springboot-starter/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>com.codingapi.springboot</groupId>
         <artifactId>springboot-parent</artifactId>
-        <version>2.10.54</version>
+        <version>2.10.55</version>
     </parent>
     <artifactId>springboot-starter</artifactId>