Add a timeout to shutdown

core/src/main/scala/ox/OxApp.scala

@@ -3,6 +3,7 @@ package ox
 import scala.util.boundary.*
 import scala.util.control.NonFatal
 import java.util.concurrent.ThreadFactory
+import scala.concurrent.duration.*
 
 enum ExitCode(val code: Int):
   case Success extends ExitCode(0)
@@ -47,7 +48,11 @@ trait OxApp:
         }
 
         // on shutdown, the above fork is cancelled, causing interruption
-        val interruptThread = new Thread(() => cancellableMainFork.cancel().discard)
+        val interruptThread =
+          new Thread(() =>
+            if timeoutOption(settings.shutdownTimeout)(cancellableMainFork.cancel()).isEmpty then
+              Console.err.println(s"Clean shutdown timed out after ${settings.shutdownTimeout}, exiting.")
+          )
         interruptThread.setName("ox-interrupt-hook")
         mountShutdownHook(interruptThread)
 
@@ -90,15 +95,44 @@ object OxApp:
     *   The thread factory that should be used to create threads in Ox scopes ([[supervised]], [[unsupervised]] etc.). Useful e.g. when
     *   integrating with third-party libraries to propagate context across (virtual) thread boundaries. If left unspecified, the default
     *   virtual thread factory is used.
+    * @param shutdownTimeout
+    *   The maximum amount of time a clean shutdown might take. This might prevent deadlocks due to usage of `System.exit` in the user's
+    *   code. After the timeout passes, the application will forcibly exit.
     */
   case class Settings(
       interruptedExitCode: ExitCode,
       handleInterruptedException: InterruptedException => Unit,
       handleException: Throwable => Unit,
-      threadFactory: Option[ThreadFactory]
-  )
+      threadFactory: Option[ThreadFactory],
+      shutdownTimeout: FiniteDuration
+  ):
+    // required for binary compatibility
+    def this(
+        interruptedExitCode: ExitCode,
+        handleInterruptedException: InterruptedException => Unit,
+        handleException: Throwable => Unit,
+        threadFactory: Option[ThreadFactory]
+    ) = this(interruptedExitCode, handleInterruptedException, handleException, threadFactory, 10.seconds)
+
+    // required for binary compatibility
+    def copy(
+        interruptedExitCode: ExitCode,
+        handleInterruptedException: InterruptedException => Unit,
+        handleException: Throwable => Unit,
+        threadFactory: Option[ThreadFactory]
+    ): Settings = Settings(interruptedExitCode, handleInterruptedException, handleException, threadFactory, shutdownTimeout)
+  end Settings
 
   object Settings:
+    // required for binary compatibility
+    def apply(
+        interruptedExitCode: ExitCode,
+        handleInterruptedException: InterruptedException => Unit,
+        handleException: Throwable => Unit,
+        threadFactory: Option[ThreadFactory]
+    ): Settings =
+      Settings(interruptedExitCode, handleInterruptedException, handleException, threadFactory, 10.seconds)
+
     val DefaultLogException: Throwable => Unit = (t: Throwable) =>
       val defaultHandler = Thread.getDefaultUncaughtExceptionHandler
       if defaultHandler != null then defaultHandler.uncaughtException(Thread.currentThread(), t) else t.printStackTrace()
@@ -111,7 +145,7 @@ object OxApp:
           case _                       => logException(t2)
 
     val Default: Settings =
-      Settings(ExitCode.Success, defaultHandleInterruptedException(DefaultLogException), DefaultLogException, None)
+      Settings(ExitCode.Success, defaultHandleInterruptedException(DefaultLogException), DefaultLogException, None, 10.seconds)
   end Settings
 
   /** Simple variant of OxApp does not pass command line arguments and exits with exit code 0 if no exceptions were thrown. */

doc/utils/oxapp.md

@@ -103,6 +103,9 @@ All `ox.OxApp` instances can be configured by overriding the `def settings: Sett
 * `threadFactory`: the thread factory that is used to create threads in Ox scopes ([[supervised]], [[unsupervised]]
    etc.). Useful e.g. when integrating with third-party libraries to propagate context across (virtual) thread 
    boundaries.
+* `shutdownTimeout`: the maximum amount of time a clean shutdown might take. By default 10 seconds. This might
+  prevent deadlocks due to usage of `System.exit` in the user's code. After the timeout passes, the application
+  will forcibly exit.
 
 Settings can be overridden: