[BigDataDZ]

A valid Gmail header such as Support (old@example.com) <sender@example.com> currently selects the address inside the comment as Mail.from; comments in To also become spurious recipients. Extract addresses from the raw header after removing comments, including nested comments and escaped parentheses, while keeping quoted display names intact.

Encoded words remain display text: parse before decoding the sender name so an encoded ( cannot consume the real address, and exclude encoded-word payloads from address matching.

Validation:

• Reproduced the incorrect sender with a failing regression test before the fix.
• All 40 Google integration tests pass, including comments, nested/escaped parentheses, quoted names, and encoded display-name punctuation.
• Independent review passed.
• Server and mobile TypeScript checks, server build, and changed-file Biome checks pass.
• Final full suite: 512 tests, 509 passed, 3 skipped, 0 failed.

[jerelvelarde]

Reviewed 24c9dff6fde4549fb50cda929307c7967329e9ed.

Prevents comment addresses and encoded display names from being mistaken for mailboxes. The bounded parser change fits the shared mail mapping path. Security: traced raw From parsing, nested/escaped comments, quoted names and To extraction; mailbox selection remains separate from displayed decoded text. No actionable security finding. Verification: 40 Google fixture tests passed. No live Gmail account or actual email send was used.

Local execution used read-only, network-disabled Linux containers with synthetic data and Node 24.17.0. Root dependency fixtures came from main’s manifest rather than the lockfile; exact-head GitHub CI covers locked full checks where green. No production credentials were supplied.