fix: add pi.dev to Pi engine firewall allowlist

pkg/workflow/README.md

@@ -1051,8 +1051,8 @@ This appendix is generated from the current non-test Go source files in this pac
 | `domains.go` | `var` | `GeminiDefaultDomains` | `var GeminiDefaultDomains = AntigravityDefaultDomains` | GeminiDefaultDomains are the default domains required for Google Gemini CLI authentication and operation. |
 | `domains.go` | `var` | `OpenCodeBaseDefaultDomains` | `var OpenCodeBaseDefaultDomains = []string{ "host.docker.internal", "github.com", "raw.githubusercontent.com", "r…` | OpenCodeBaseDefaultDomains are the default domains required for OpenCode CLI operation. |
 | `domains.go` | `var` | `OpenCodeDefaultDomains` | `var OpenCodeDefaultDomains = []string{ "api.githubcopilot.com", "api.openai.com", "generativelanguage.google…` | OpenCodeDefaultDomains are the static default domains for backward compatibility. |
-| `domains.go` | `var` | `PiBaseDefaultDomains` | `var PiBaseDefaultDomains = []string{ "api.pi.ai", "host.docker.internal", "github.com", "raw.githubusercon…` | PiBaseDefaultDomains are the base domains required for the Pi CLI to operate, independent of the chosen LLM provider. |
-| `domains.go` | `var` | `PiDefaultDomains` | `var PiDefaultDomains = []string{ "api.githubcopilot.com", "api.pi.ai", "host.docker.internal", "github…` | PiDefaultDomains are the static default domains for backward compatibility when no model provider prefix is given. |
+| `domains.go` | `var` | `PiBaseDefaultDomains` | `var PiBaseDefaultDomains = []string{ "host.docker.internal", "github.com", "raw.githubusercon…` | PiBaseDefaultDomains are the base domains required for the Pi CLI to operate, independent of the chosen LLM provider. |
+| `domains.go` | `var` | `PiDefaultDomains` | `var PiDefaultDomains = []string{ "api.githubcopilot.com", "host.docker.internal", "github…` | PiDefaultDomains are the static default domains for backward compatibility when no model provider prefix is given. |
 | `domains.go` | `var` | `PlaywrightDomains` | `var PlaywrightDomains = []string{ "cdn.playwright.dev", "playwright.download.prss.microsoft.com", }` | PlaywrightDomains are the domains required for Playwright browser downloads These domains are needed when Playwright MCP server initializes in the Docker container |
 | `expression_patterns.go` | `var` | `AWImportInputsExpressionPattern` | `var AWImportInputsExpressionPattern = regexp.MustCompile(`\$\{\{\s*github\.aw\.import-inputs\.([a-zA-Z0-9_-]+(?:\.[a-…` | AWImportInputsExpressionPattern matches full ${{ github. |
 | `expression_patterns.go` | `var` | `AWImportInputsPattern` | `var AWImportInputsPattern = regexp.MustCompile(`^github\.aw\.import-inputs\.[a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-…` | AWImportInputsPattern matches github. |

pkg/workflow/domains.go

@@ -146,7 +146,6 @@ var GeminiDefaultDomains = AntigravityDefaultDomains
 // independent of the chosen LLM provider. When a model uses provider/model format,
 // provider-specific API domains are added on top via GetDefaultDomainsForEngine.
 var PiBaseDefaultDomains = []string{
-	"api.pi.ai",            // Pi CLI telemetry / update checks
 	"host.docker.internal", // MCP gateway / API proxy access
 	"github.com",
 	"raw.githubusercontent.com",
@@ -172,7 +171,6 @@ var piProviderDomains = map[string]string{
 // dynamic path (GetDefaultDomainsForEngine) resolves provider-specific domains instead.
 var PiDefaultDomains = []string{
 	"api.githubcopilot.com", // Default provider (Copilot routing)
-	"api.pi.ai",
 	"host.docker.internal",
 	"github.com",
 	"raw.githubusercontent.com",

pkg/workflow/pi_engine.go

@@ -487,6 +487,13 @@ touch %s
 		env["GH_AW_VERSION"] = "dev"
 	}
 
+	// Disable Pi startup network operations (version check, install telemetry,
+	// and remote model-catalog refresh against pi.dev). None of these are needed
+	// in CI: the AWF api-proxy provides models.json, version checks add latency,
+	// and telemetry is not relevant in an automated runner context.
+	// See: https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md
+	env["PI_OFFLINE"] = "1"
+
 	// When the AWF firewall is enabled, set git identity environment variables
 	// for commit authorship and signal to the Pi extension that the AWF api-proxy
 	// sidecar is running so the /reflect preflight is not skipped.