iMessage echo bug: isFromMe + isSamePhone messages not filtered

[hansmon]

Summary

Outbound iMessage messages sent by OC are being re-ingested as inbound messages, triggering duplicate agent responses and burning tokens.

Environment

• OC version: 2026.4.1
• imsg CLI: 0.5.0
• Platform: macOS (Mac Mini M4)

Reproduction

1. User messages Alfred via iMessage from phone
2. Alfred runs gateway config.patch with a note parameter
3. Note is delivered to iMessage (same phone number as user)
4. iMessage bridge sees the outbound message and re-ingests it as inbound
5. Main agent responds to its own message → burns Opus tokens

Root Cause

In access-control-*.js, the logic allows messages where isSamePhone === true:

if (!params.group && isSamePhone) return true;

This is intended for self-chat use cases, but doesn't account for outbound echoes.

The isFromMe flag IS correctly set by imsg CLI, but OC doesn't check it when isSamePhone is true.

Expected Behavior

Messages where isFromMe === true AND isSamePhone === true should be SKIPPED (not processed as inbound), because they are Alfred talking to Alfred via the user's iMessage account.

Workaround

Moved cron deliveries from iMessage to webchat. But config.patch notes and other system messages still trigger the echo.

Impact

• Burned ~8% weekly Opus quota in 30 minutes from echo loops
• 78k tokens on 3 API calls responding to own messages