iMessage channel sends permission relay prompts to unrelated contact

Bug Summary

The iMessage channel plugin sent permission relay prompts to an unrelated contact (my wife) who was not in any allowlist and had not sent me a message. The prompts contained internal tool names and approval codes.

Environment

• Claude Code: v2.1.86
• macOS: 26.3.1
• Terminal: Ghostty
• Plugin: imessage@claude-plugins-official

Steps to Reproduce

1. Installed iMessage plugin via /plugin install imessage@claude-plugins-official
2. Started Claude Code with claude --channels plugin:imessage@claude-plugins-official
3. Texted myself to test the channel (worked as expected)
4. At 7:11 AM ET, my wife received two unsolicited permission relay messages from my phone number — despite:

• Her last text to me was at 6:00 PM ET the previous evening (13 hours prior)
• She sent no messages to me in the interim
• I sent no messages to her in the interim
• No allowlist had been configured (default policy was in effect)

What Was Sent

My wife received two iMessage texts from my number:

🔒 Permission request [shihb] mcp__plugin_imessage_imessage__reply: Reply on iMessage. Pass chat_id from the inbound message. Optionally pass files (absolute paths) to attach images or other files. Reply "yes shihb" to allow or "no shihb" to deny.

🔒 Permission request [iegyw] Skill: Execute skill: last30days Reply "yes iegyw" to allow or "no iegyw" to deny.

Expected Behavior

• Permission relay prompts should only be sent to the user's own self-chat or to explicitly allowlisted contacts
• The channel should not process messages from conversations that predate the channel session startup
• Internal tool names and approval codes should never be sent to unrelated contacts

Actual Behavior

• Permission prompts were sent to an unapproved contact's conversation
• No inbound message from that contact triggered the event
• The channel appears to have either: (a) picked up a 13-hour-old message as "new" on startup, or (b) routed prompts to the wrong conversation thread

Impact

This is a privacy and trust issue. An AI sent unsolicited messages containing internal system information to a family member from my personal phone number, with no trigger and no authorization.