v0.7.0

Added

• Perplexity backend (#59): dedicated Perplexity factory in Settings → Backend with the standard URL / Model / API key / Headers / Timeout fields. Targets https://api.perplexity.ai/chat/completions (no /v1 prefix) and ships sensible defaults for the Sonar family (sonar, sonar-pro, sonar-reasoning, sonar-reasoning-pro, sonar-deep-research, r1-1776). The model is a free-form field so any future Perplexity model name works without an extension update. ServiceLoader registers the factory automatically; no MCP / settings migration needed.
• AI scan on selected insertion point (#46): new right-click entry "AI Scan on Selected Insertion Point" that scopes an active scan to the parameter / header / JSON field overlapping the user's text selection in the request editor. Resolves URL/BODY/COOKIE parameters via Montoya's ParsedHttpParameter.valueOffsets(), falls back to header line matching and JSON/XML body field substring match. Reuses the existing vuln class picker (showVulnClassSelectionDialog) and queues one ActiveScanTarget per selected class with priority 60 so insertion-point scans jump ahead of the background passive queue. The menu item is hidden when there is no editor selection or the selection misses every candidate.
• Custom prompt library UX (#47): the Settings → Prompt Templates editor gains:
  • A live search filter that matches case-insensitively across title and prompt text.
  • A ★ Favorite toggle that pins entries to the top — favorites are persisted, surfaced first in the right-click submenus, and round-trip through import/export.
  • JSON Import / Export buttons. Export writes a pretty-printed .json with favorites first; import merges by id (existing entries replaced, new ones appended) and de-duplicates the input file defensively so malformed exports cannot introduce ambiguous ids.
  • Move Up / Down now respects the favorites grouping so reorders cannot scramble it.

Changed

• OpenAiCompatibleBackend is more configurable, no behavior change for existing backends: two new constructor parameters with backwards-compatible defaults, used to wire Perplexity into the same code path as NVIDIA NIM / Generic OpenAI-compatible without forking the connection class.
  • chatCompletionsBasePath: String = "/v1/chat/completions" — overridden by Perplexity to "/chat/completions" because its API has no /v1 prefix. The bare-host fallback in buildChatCompletionsUrl now uses this value; explicit /v\d+ user URLs are unaffected.
  • supportsJsonObjectResponseFormat: Boolean = true — Perplexity's Sonar API rejects {"type":"json_object"}, so the connection skips the response_format field for that backend even when callers (e.g. the passive scanner) set jsonMode = true. Scanner prompts continue to ask for JSON in the system message.
• AgentSettings schema (additive): 5 new optional fields (perplexityUrl, perplexityModel, perplexityApiKey, perplexityHeaders, perplexityTimeoutSeconds) and 1 new optional field on CustomPromptDefinition (isFavorite). All default to safe values, so saved settings from earlier versions load unchanged. No migrateIfNeeded bump required.
• Custom prompt library order on save: CustomPromptLibraryEditor.snapshot() now persists entries with favorites first. Right-click submenus iterate library order via filterForMenu, so the visible menu order matches the editor without any extra sorting.
• Safety indicator in the main tab header: replaced the full-width red "safety strip" under the top bar with a compact Safety: OK / Warn / Risk pill placed alongside the existing MCP / AI / Session badges. The pill background encodes the level (statusRunning / statusTerminal / statusCrashed) and the full four-flag breakdown (Privacy mode, MCP exposure, Unsafe state, passive/active scanners) stays available as an HTML tooltip. Theme switches in Burp re-paint the pill without a plugin reload.
• Settings panel — new "Custom Prompts" tab: the previous "Prompt Templates" tab is split in two. "Prompt Templates" now hosts only the request / issue prompt fields; a new dedicated Custom Prompts tab consolidates the prompt library editor and the BountyPrompt integration that used to live as nested sections of the prompts tab. No settings keys change, so saved configurations load unchanged.
• Settings advisory banners (SubtleNotice): Privacy & Logging and MCP Server tabs now render advisory state through a single theme-aware banner component instead of three stacked red labels. The banner picks INFO / WARN / RISK automatically (Privacy OFF with MCP on, Privacy STRICT with active scanner on, external MCP without allowed origins, external + Unsafe MCP, etc.), supports multi-line HTML wrapping inside GridBagLayout rows, and collapses cleanly when there is nothing to report — no dangling "Advisory:" label remains visible.

Fixed

• Perplexity backend not appearing in the backend dropdown: BackendRegistry was registering only 9 hardcoded built-ins (missing Perplexity) because the JVM ServiceLoader.load(clazz) overload uses Thread.currentThread().contextClassLoader, which under Burp's per-extension classloader cannot see this JAR's META-INF/services/...AiBackendFactory file. ServiceLoader silently returned an empty list, the code fell through to the in-code fallback array, and that array did not include PerplexityBackendFactory. Fixed by passing AiBackendFactory::class.java.classLoader explicitly to ServiceLoader.load() so all registered factories resolve regardless of which classloader Burp installs as the thread context (also benefits any future drop-in backend). PerplexityBackendFactory() is additionally added to the fallback list as a belt-and-suspenders safety net.
• Burp Pro "Use AI" toggle no longer blocks independent backends: Burp Pro's Use AI preference is now only enforced against the burp-ai backend, which delegates inference to Burp's bundled AI provider. Every other backend in the plugin — Ollama, LM Studio, OpenAI-compatible, NVIDIA NIM, Perplexity, and all CLI agents (Claude, Codex, Gemini, OpenCode, Copilot) — is independent of Burp's AI features and now keeps working when the toggle is off. Burp Community users were affected by the same gate because api.ai().isEnabled() returns false there. AgentSupervisor exposes new requiresBurpAiAndDisabled(backendId) and isBlockedByBurpAiGate() helpers; ChatPanel, PassiveAiScanner, and ActiveAiScanner route their gating through them. Error messaging on the burp-ai startup path now reads "Burp AI is disabled in Burp Suite settings. Enable 'Use AI' for extensions, or pick a different backend." Regression locked by BurpAiGateScopingTest.

Upgrade Notes

• Perplexity API key: if you previously configured Perplexity via the Generic OpenAI-compatible backend, switch to the dedicated Perplexity entry in Settings → Backend; the dedicated factory uses the right URL shape and skips the unsupported response_format field automatically.
• Saved prompt libraries: existing entries load with isFavorite = false. Open Settings → Custom Prompts and click ★ Favorite on the prompts you want pinned; the edit dialog also exposes the same toggle.
• Custom Prompts moved: if you previously edited the prompt library or BountyPrompt under Settings → Prompt Templates, those controls now live under the new Settings → Custom Prompts tab. No data migration required.
• Burp Pro users: with the "Use AI" gate fix, leaving Burp Pro's AI toggle off no longer prevents the plugin from using independent backends. If you intentionally want to disable AI plugin-wide, disable it via the plugin (stop session / disable passive + active scanners) rather than relying on Burp's preference.

What's Changed

• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #49
• Bump actions/checkout from 4 to 6 by @dependabot[bot] in #50
• Bump gradle/actions from 4 to 6 by @dependabot[bot] in #51
• Bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #52
• Bump the jackson group with 2 updates by @dependabot[bot] in #55
• Bump org.junit.jupiter:junit-jupiter from 5.11.3 to 6.0.3 by @dependabot[bot] in #56
• Bump org.gradle.toolchains.foojay-resolver-convention from 0.9.0 to 1.0.0 by @dependabot[bot] in #57
• Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #58

New Contributors

• @dependabot[bot] made their first contribution in #49

Full Changelog: v0.6.1...v0.7.0