@eryxenx/insta-chat 2.0.6 → 2.0.8

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@eryxenx/insta-chat` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/) and uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.0.8] - 2026-10-11
+
+### Fixed
+
+- **`unsendMessage` never deleted the message.** The REST delete request was
+  sent with an empty body, which Instagram rejects with `status: "fail"` (or a
+  404/redirect). The web client sends `_csrftoken` and `_uuid`, so `/unsend`
+  now includes both. Previously the call resolved to `false`, which the bot
+  surfaced as "Could not unsend this message (Instagram refused it, or the
+  message is too old)."
+
+## [2.0.7] - 2026-10-11
+
+### Fixed
+
+- **`unsendMessage` silently failed for a message the bot did not send in this
+  process.** The thread of the id being unsent was resolved only from the
+  in-memory `messageID -> threadID` map, so unsending a message sent before a
+  restart (or a reply to someone else's message) threw `Unknown thread for
+  message` internally and returned `false` — `/unsend` appeared to do nothing.
+  `unsendMessage(messageID, callback?, threadID?)` now accepts the thread
+  explicitly, and the normalizer remembers the replied-to message id (whose
+  thread is known) so the map lookup succeeds. The thread the message was seen
+  in is always a safe explicit value for `/unsend`.
+
 ## [2.0.6] - 2026-10-10
 
 ### Added

package/DOCS.md

@@ -58,7 +58,7 @@ Facebook-Chat-API shape. Its methods live one-per-file under
 
 | Group | Methods |
 |-------|---------|
-| messaging | `sendMessage(form, threadID, cb?, replyToMessage?)`, `sendMessageSync`, `editMessage(text, messageID)`, `unsendMessage(messageID)`, `setMessageReaction(emoji, messageID, cb?, threadID?)`, `sendTypingIndicator`, `markAsRead`, `shareContact`, `resolvePhotoUrl` |
+| messaging | `sendMessage(form, threadID, cb?, replyToMessage?)`, `sendMessageSync`, `editMessage(text, messageID)`, `unsendMessage(messageID, cb?, threadID?)`, `setMessageReaction(emoji, messageID, cb?, threadID?)`, `sendTypingIndicator`, `markAsRead`, `shareContact`, `resolvePhotoUrl` |
 | threads | `getThreadInfo`, `getThreadList`, `getThreadHistory` |
 | users | `getUserInfo`, `getUID`, `getProfilePictureUrl` |
 | account | `getCurrentUserID`, `getAppState`, `getCookies`, `setOptions` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eryxenx/insta-chat",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": " Unofficial Instagram Chat API for Node.js | Build Instagram DM bots on personal accounts \u2014 send messages, media, voice notes, reactions, edit & unsend, listen for incoming chats. No browser at runtime",
   "main": "index.js",
   "types": "index.d.ts",
@@ -23,7 +23,7 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "test": "node test/smoke.js && node test/antiSuspension.test.js && node test/replyContent.test.js && node test/edit.test.js && node test/sendReply.test.js && node test/client.test.js && node test/relayError.test.js && node test/safetyWiring.test.js && node test/mediaOrder.test.js && node test/sessionSafety.test.js && node test/emptySend.test.js && node test/pollFloor.test.js",
+    "test": "node test/smoke.js && node test/antiSuspension.test.js && node test/replyContent.test.js && node test/edit.test.js && node test/sendReply.test.js && node test/client.test.js && node test/relayError.test.js && node test/safetyWiring.test.js && node test/mediaOrder.test.js && node test/sessionSafety.test.js && node test/emptySend.test.js && node test/pollFloor.test.js && node test/unsend.test.js",
     "build": "node scripts/build.js"
   },
   "keywords": [

package/src/api/messaging/unsendMessage.js

@@ -5,12 +5,16 @@
  * Original author credit must be retained in all copies and derivatives.
  */
 
-// fca.unsendMessage(messageID) — the thread is resolved from the id.
+// fca.unsendMessage(messageID, callback, threadID) — the thread may be passed
+// explicitly; otherwise it is resolved from the id. A bot that only knows the
+// replied-to message id (it did not send that message in this process, e.g.
+// after a restart) cannot resolve the thread, so the explicit thread is what
+// makes /unsend work reliably.
 module.exports = function (client) {
-  return async function unsendMessage(messageID, callback) {
+  return async function unsendMessage(messageID, callback, threadID) {
     const cb = typeof callback === "function" ? callback : null;
     try {
-      const tid = client._resolveThread(messageID);
+      const tid = client._resolveThread(messageID, threadID);
       const ok = await client.api.unsendMessage(tid, String(messageID));
       if (cb) cb(null, ok);
       return ok;

package/src/api.js

@@ -43,7 +43,7 @@ class InstaAPI {
     const sessionParams = options.sessionParams || this._loadSessionParams(options.sessionParamsFile);
     if (sessionParams) this.http.setSessionParams(sessionParams);
 
-    this.message = new MessageMethods(this.http);
+    this.message = new MessageMethods(this.http, this.identity);
     this.reaction = new ReactionMethods(this.http);
     this.typing = new TypingMethods(this.http);
     this.thread = new ThreadMethods(this.http);

package/src/app/InstaContext.js

@@ -29,7 +29,7 @@ class InstaContext {
   }
 
   unsend(messageID, callback) {
-    return this.client.unsendMessage(messageID, callback);
+    return this.client.unsendMessage(messageID, callback, this.threadID);
   }
 
   edit(text, messageID, callback) {

package/src/events/normalizeEvent.js

@@ -139,6 +139,12 @@ class EventNormalizer {
     // client must know which thread it belongs to.
     if (typeof this.client.rememberThread === "function") {
       this.client.rememberThread(event.messageID, threadID);
+      // Remember the replied-to message too: /unsend resolves its thread from
+      // that id, and the bot may be unssending a message it sent in an earlier
+      // process (so it is not in _msgThread otherwise).
+      if (event.messageReply && event.messageReply.messageID) {
+        this.client.rememberThread(event.messageReply.messageID, threadID);
+      }
     }
 
     return event;

package/src/methods/message.js

@@ -12,8 +12,9 @@ const { classify } = require("../utils/errors");
 const NO_FALLBACK_KINDS = new Set(["rate_limited", "challenge", "blocked", "suspended", "auth"]);
 
 class MessageMethods {
-  constructor(http) {
+  constructor(http, identity) {
     this.http = http;
+    this.identity = identity;
   }
 
   // Confirmed send path from a live web session: the IGDirectTextSendMutation
@@ -98,8 +99,14 @@ class MessageMethods {
     });
   }
 
+  // Instagram's REST delete requires the request to look like the web client's:
+  // a `_csrftoken` (the csrftoken cookie) and a `_uuid` (the browser/device id).
+  // An empty body is rejected — Instagram answers with `status: "fail"` (or a
+  // 404/redirect), which made `unsend` a silent no-op.
   async unsend(threadID, itemID) {
-    const res = await this.http.postForm(EP.ITEM_DELETE(threadID, itemID), {});
+    const csrf = this.http.getCookie("csrftoken");
+    const body = { _csrftoken: csrf, _uuid: this.identity?.uuid || this.http.uuid() };
+    const res = await this.http.postForm(EP.ITEM_DELETE(threadID, itemID), body);
     return res?.status === "ok";
   }