fix(cli): plug parent-env REDIS_URL leak and add coverage (MAY-1086)

Address staff-engineer review on #365:

- Pop REDIS_URL from the inherited env when redis_enabled is false. The
  previous implementation only avoided seeding a default, so a stale
  REDIS_URL exported by the parent shell still leaked into the agent
  process and reproduced the same silent hang the opt-out was meant to
  prevent.
- Drop the unreachable `local_development is None` short-circuit; the
  dict literal above already dereferences manifest.local_development with
  a # type: ignore[union-attr], so the None branch can never run.
- Add tests/lib/cli/test_run_handlers.py covering the three branches:
  default seeds REDIS_URL, opt-out with clean parent env clears it,
  opt-out with a parent-shell REDIS_URL still clears it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: IdkwhatImD0ing

src/agentex/lib/cli/handlers/run_handlers.py

@@ -374,9 +374,12 @@ def create_agent_environment(manifest: AgentManifest) -> dict[str, str]:
     # Gate the default REDIS_URL on an explicit manifest flag. Agents that don't use
     # adk.messages/adk.streaming can set local_development.redis_enabled: false to avoid
     # the localhost:6379 default, which otherwise causes silent request hangs when no
-    # local Redis is reachable (MAY-1086).
-    if manifest.local_development is None or manifest.local_development.redis_enabled:
+    # local Redis is reachable (MAY-1086). When opting out, also drop any REDIS_URL the
+    # parent shell may have exported, so the opt-out actually guarantees a clean env.
+    if manifest.local_development.redis_enabled:  # type: ignore[union-attr]
         env_vars["REDIS_URL"] = "redis://localhost:6379"
+    else:
+        env.pop("REDIS_URL", None)
 
     if manifest.agent.agent_input_type:
         env_vars["AGENT_INPUT_TYPE"] = manifest.agent.agent_input_type

tests/lib/cli/test_run_handlers.py

@@ -0,0 +1,53 @@
+"""Tests for run_handlers.create_agent_environment — REDIS_URL gating (MAY-1086)."""
+
+from __future__ import annotations
+
+import pytest
+
+from agentex.lib.cli.handlers.run_handlers import create_agent_environment
+from agentex.lib.sdk.config.agent_manifest import AgentManifest
+
+
+@pytest.fixture
+def manifest_path() -> str:
+    """A real tutorial manifest with acp_type=async and default redis_enabled."""
+    return "examples/tutorials/10_async/00_base/110_pydantic_ai/manifest.yaml"
+
+
+class TestCreateAgentEnvironmentRedisGating:
+    def test_default_seeds_redis_url(self, manifest_path: str, monkeypatch: pytest.MonkeyPatch):
+        """With redis_enabled unset (default true), CLI seeds the localhost REDIS_URL."""
+        monkeypatch.delenv("REDIS_URL", raising=False)
+        manifest = AgentManifest.from_yaml(file_path=manifest_path)
+        assert manifest.local_development is not None
+        assert manifest.local_development.redis_enabled is True
+
+        env = create_agent_environment(manifest)
+
+        assert env.get("REDIS_URL") == "redis://localhost:6379"
+
+    def test_opt_out_clears_redis_url_when_parent_env_clean(
+        self, manifest_path: str, monkeypatch: pytest.MonkeyPatch
+    ):
+        """With redis_enabled=false and no parent REDIS_URL, REDIS_URL is absent."""
+        monkeypatch.delenv("REDIS_URL", raising=False)
+        manifest = AgentManifest.from_yaml(file_path=manifest_path)
+        assert manifest.local_development is not None
+        manifest.local_development.redis_enabled = False
+
+        env = create_agent_environment(manifest)
+
+        assert "REDIS_URL" not in env
+
+    def test_opt_out_clears_redis_url_when_parent_env_has_one(
+        self, manifest_path: str, monkeypatch: pytest.MonkeyPatch
+    ):
+        """With redis_enabled=false, a stale parent-shell REDIS_URL must not leak through."""
+        monkeypatch.setenv("REDIS_URL", "redis://leftover.from.parent.shell:6379")
+        manifest = AgentManifest.from_yaml(file_path=manifest_path)
+        assert manifest.local_development is not None
+        manifest.local_development.redis_enabled = False
+
+        env = create_agent_environment(manifest)
+
+        assert "REDIS_URL" not in env