Harden AI integration per BApp reviewer feedback (v2.1.1)

[liam-portswigger]

Addresses the three items from the BApp Store automated review of the AI integration.

1. AiClient threading (performance correctness)

The single-thread executor meant concurrent scan threads queued on one worker — a thread could hit its 2s timeout while still waiting in the queue, not during the actual call. Replaced with a bounded fixed thread pool (4 daemon workers) so concurrent callers run in parallel and the timeout measures real in-flight time. shutdown() is unchanged.

2. AiTriage prompt injection (security — the serious one)

Attacker-controlled response content was concatenated straight into the prompt, so a crafted server response could instruct the model to return SUPPRESS and silently drop a legitimate finding. Fixed:

• Trusted fields (finding name/severity) now sit outside the untrusted block; all HTTP-derived content sits inside <http_exchange> tags.
• System prompt instructs the model to treat tag contents as data only and never obey instructions within them.
• Delimiter tokens are neutralised in untrusted content so a forged </http_exchange> can't break out.
• parseVerdict is now strict safe-failure: only a well-formed JSON object whose verdict is exactly SUPPRESS suppresses; anything else (unparseable, wrong type, prose, markdown-fenced) → KEEP. Added tolerant {...} extraction for fenced replies.

3. AiFieldDiscovery prompt injection

Same structural-delimiter treatment — method/path/key-names wrapped in <http_context> tags with a data-only instruction and delimiter neutralisation. The downstream sanitiseAndDedupe allowlist already bounded practical impact; this closes the steering gap.

Diff

9 files, +123 / −47. AI layer only — no scan-check detection logic touched.

Test plan

• mvn clean package clean.
• CI green.
• Reviewer re-check of the three items.

Releases as v2.1.1. Follow-up to submission extension-portal#439.