cluster0: fix secrets MAIL_FROM parsing; normalize RFC5322 From in compose

load_secrets_lab quotes values safely; compose reads MAIL_FROM via read_secret.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/compose-lab-backend.sh

@@ -118,7 +118,8 @@ AUTH_KEY="${AUTH_ENCRYPTION_KEY:-lab-cluster-dev-32-char-min-secret!!}"
 _MSMTP_PASS="$(read_secret MSMTP_APP_PASSWORD 2>/dev/null || true)"
 [ -n "$_MSMTP_PASS" ] || _MSMTP_PASS="${MSMTP_APP_PASSWORD:-}"
 MAIL_TRANSPORT="${MAIL_TRANSPORT:-sendmail}"
-MAIL_FROM="${MAIL_FROM:-Android Cast Lab <bestcastr@gmail.com>}"
+_mail_from_secret="$(read_secret MAIL_FROM 2>/dev/null || true)"
+[ -n "$_mail_from_secret" ] || _mail_from_secret="${MAIL_FROM:-}"
 MAIL_REPLY="${MAIL_REPLY_TO:-bestcastr@gmail.com}"
 SMTP_HOST="${SMTP_HOST:-127.0.0.1}"
 SMTP_PORT="${SMTP_PORT:-587}"
@@ -130,9 +131,11 @@ if [ -n "$_MSMTP_PASS" ]; then
   SMTP_HOST=smtp.gmail.com
   SMTP_USER="${MSMTP_USER:-bestcastr@gmail.com}"
   SMTP_PASS="$_MSMTP_PASS"
-  MAIL_FROM="${MAIL_FROM:-Android Cast <bestcastr@gmail.com>}"
 fi
-unset _MSMTP_PASS
+MAIL_FROM="$(normalize_mail_from "$_mail_from_secret" "$SMTP_USER")"
+[ -n "$MAIL_FROM" ] || MAIL_FROM="Android Cast Lab <${SMTP_USER:-bestcastr@gmail.com}>"
+unset _MSMTP_PASS _mail_from_secret
+MAIL_FROM_PHP="$(printf '%s' "$MAIL_FROM" | sed "s/'/\\\\'/g")"
 AUTH_BEARER_ID="$(read_secret URL_SHORTENER_AUTH_BEARER_ID 2>/dev/null || true)"
 [ -n "$AUTH_BEARER_ID" ] || AUTH_BEARER_ID="${URL_SHORTENER_AUTH_BEARER_ID:-0}"
 mkdir -p "${COMPOSED}/config"
@@ -174,7 +177,7 @@ return [
     ],
     'mail' => [
         'transport' => '${MAIL_TRANSPORT}',
-        'from' => '${MAIL_FROM}',
+        'from' => '${MAIL_FROM_PHP}',
         'reply_to' => '${MAIL_REPLY}',
         'smtp' => [
             'host' => '${SMTP_HOST}',

sim/cluster0/scripts/lib/common.sh

@@ -189,21 +189,55 @@ read_cred() {
 load_secrets_lab() {
   _file="${CAST_CLUSTER_ROOT}/secrets.lab.env"
   [ -f "$_file" ] || return 0
-  # Export only simple KEY=value lines (no shell metacharacters in values via source).
+  _tmp="/tmp/cast-secrets-load-$$"
+  : > "$_tmp"
   while IFS= read -r _line || [ -n "$_line" ]; do
     case "$_line" in
       ''|\#*) continue ;;
       *=*)
         _k="${_line%%=*}"
         _v="${_line#*=}"
+        case "$_v" in
+          \"*) _v="${_v#\"}"; _v="${_v%\"}" ;;
+        esac
         case "$_k" in
           MAIL_*|MSMTP_*|SMTP_*|AUTH_*|GITEA_*|WG_*|RSSH_*|URL_SHORTENER_*)
-            export "$_k=$_v"
+            _v_escaped="$(printf '%s' "$_v" | sed "s/'/'\\\\''/g")"
+            printf "%s='%s'\n" "$_k" "$_v_escaped" >> "$_tmp"
             ;;
         esac
         ;;
     esac
   done < "$_file"
+  # shellcheck disable=SC1090
+  . "$_tmp"
+  rm -f "$_tmp"
+}
+
+# RFC5322 From — secrets without angle brackets break Gmail SMTP (shell ate <email>).
+normalize_mail_from() {
+  _in="$1"
+  _smtp_user="${2:-}"
+  case "$_in" in
+    *'<'*'>'*) printf '%s' "$_in"; return ;;
+  esac
+  case "$_in" in
+    *@*)
+      _email="$(printf '%s' "$_in" | awk '{print $NF}')"
+      _name="$(printf '%s' "$_in" | sed "s/ ${_email}\$//")"
+      if [ -n "$_name" ]; then
+        printf '%s <%s>' "$_name" "$_email"
+      else
+        printf '%s' "$_email"
+      fi
+      return
+      ;;
+  esac
+  if [ -n "$_smtp_user" ] && printf '%s' "$_smtp_user" | grep -q '@'; then
+    printf 'Android Cast Lab <%s>' "$_smtp_user"
+    return
+  fi
+  printf '%s' "$_in"
 }
 
 read_secret() {
@@ -213,6 +247,8 @@ read_secret() {
   awk -v k="$_key" '
     $0 ~ "^" k "=" {
       sub("^" k "=", "")
+      sub(/^"/, "")
+      sub(/"$/, "")
       print
       exit
     }

sim/cluster0/scripts/verify-mail-lab.sh

@@ -35,7 +35,8 @@ echo ($ok ? "mail_ok" : "mail_fail") . " short=" . $short;
 
 log "$_out to=$TO"
 if echo "$_out" | grep -q mail_ok; then
-  log "hint: expect s.f0xx.org short link + inline QR via s.f0xx.org/api/v1/qr/…png (encodes …&src=qr)"
+  log "hint: expect s.f0xx.org short link + QR image URL in plain text (encodes …&src=qr)"
+  log "hint: Gmail relay may still async-bounce verify mail — check spam + mailer-daemon"
 fi
 case "$_out" in
   mail_ok) exit 0 ;;