@eryxenx/insta-chat 2.0.7 → 2.0.8

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `@eryxenx/insta-chat` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/) and uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.0.8] - 2026-10-11
+
+### Fixed
+
+- **`unsendMessage` never deleted the message.** The REST delete request was
+  sent with an empty body, which Instagram rejects with `status: "fail"` (or a
+  404/redirect). The web client sends `_csrftoken` and `_uuid`, so `/unsend`
+  now includes both. Previously the call resolved to `false`, which the bot
+  surfaced as "Could not unsend this message (Instagram refused it, or the
+  message is too old)."
+
 ## [2.0.7] - 2026-10-11
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eryxenx/insta-chat",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": " Unofficial Instagram Chat API for Node.js | Build Instagram DM bots on personal accounts \u2014 send messages, media, voice notes, reactions, edit & unsend, listen for incoming chats. No browser at runtime",
   "main": "index.js",
   "types": "index.d.ts",

package/src/api.js

@@ -43,7 +43,7 @@ class InstaAPI {
     const sessionParams = options.sessionParams || this._loadSessionParams(options.sessionParamsFile);
     if (sessionParams) this.http.setSessionParams(sessionParams);
 
-    this.message = new MessageMethods(this.http);
+    this.message = new MessageMethods(this.http, this.identity);
     this.reaction = new ReactionMethods(this.http);
     this.typing = new TypingMethods(this.http);
     this.thread = new ThreadMethods(this.http);

package/src/methods/message.js

@@ -12,8 +12,9 @@ const { classify } = require("../utils/errors");
 const NO_FALLBACK_KINDS = new Set(["rate_limited", "challenge", "blocked", "suspended", "auth"]);
 
 class MessageMethods {
-  constructor(http) {
+  constructor(http, identity) {
     this.http = http;
+    this.identity = identity;
   }
 
   // Confirmed send path from a live web session: the IGDirectTextSendMutation
@@ -98,8 +99,14 @@ class MessageMethods {
     });
   }
 
+  // Instagram's REST delete requires the request to look like the web client's:
+  // a `_csrftoken` (the csrftoken cookie) and a `_uuid` (the browser/device id).
+  // An empty body is rejected — Instagram answers with `status: "fail"` (or a
+  // 404/redirect), which made `unsend` a silent no-op.
   async unsend(threadID, itemID) {
-    const res = await this.http.postForm(EP.ITEM_DELETE(threadID, itemID), {});
+    const csrf = this.http.getCookie("csrftoken");
+    const body = { _csrftoken: csrf, _uuid: this.identity?.uuid || this.http.uuid() };
+    const res = await this.http.postForm(EP.ITEM_DELETE(threadID, itemID), body);
     return res?.status === "ok";
   }