cluster0: fix secrets MAIL_FROM parsing; normalize RFC5322 From in compose

load_secrets_lab quotes values safely; compose reads MAIL_FROM via read_secret.

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/scripts/lib/common.sh

@@ -189,21 +189,55 @@ read_cred() {
 load_secrets_lab() {
   _file="${CAST_CLUSTER_ROOT}/secrets.lab.env"
   [ -f "$_file" ] || return 0
-  # Export only simple KEY=value lines (no shell metacharacters in values via source).
+  _tmp="/tmp/cast-secrets-load-$$"
+  : > "$_tmp"
   while IFS= read -r _line || [ -n "$_line" ]; do
     case "$_line" in
       ''|\#*) continue ;;
       *=*)
         _k="${_line%%=*}"
         _v="${_line#*=}"
+        case "$_v" in
+          \"*) _v="${_v#\"}"; _v="${_v%\"}" ;;
+        esac
         case "$_k" in
           MAIL_*|MSMTP_*|SMTP_*|AUTH_*|GITEA_*|WG_*|RSSH_*|URL_SHORTENER_*)
-            export "$_k=$_v"
+            _v_escaped="$(printf '%s' "$_v" | sed "s/'/'\\\\''/g")"
+            printf "%s='%s'\n" "$_k" "$_v_escaped" >> "$_tmp"
             ;;
         esac
         ;;
     esac
   done < "$_file"
+  # shellcheck disable=SC1090
+  . "$_tmp"
+  rm -f "$_tmp"
+}
+
+# RFC5322 From — secrets without angle brackets break Gmail SMTP (shell ate <email>).
+normalize_mail_from() {
+  _in="$1"
+  _smtp_user="${2:-}"
+  case "$_in" in
+    *'<'*'>'*) printf '%s' "$_in"; return ;;
+  esac
+  case "$_in" in
+    *@*)
+      _email="$(printf '%s' "$_in" | awk '{print $NF}')"
+      _name="$(printf '%s' "$_in" | sed "s/ ${_email}\$//")"
+      if [ -n "$_name" ]; then
+        printf '%s <%s>' "$_name" "$_email"
+      else
+        printf '%s' "$_email"
+      fi
+      return
+      ;;
+  esac
+  if [ -n "$_smtp_user" ] && printf '%s' "$_smtp_user" | grep -q '@'; then
+    printf 'Android Cast Lab <%s>' "$_smtp_user"
+    return
+  fi
+  printf '%s' "$_in"
 }
 
 read_secret() {
@@ -213,6 +247,8 @@ read_secret() {
   awk -v k="$_key" '
     $0 ~ "^" k "=" {
       sub("^" k "=", "")
+      sub(/^"/, "")
+      sub(/"$/, "")
       print
       exit
     }