@eryxenx/insta-chat 2.0.8 → 2.0.10

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to `@eryxenx/insta-chat` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/) and uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.0.10] - 2026-10-11
+
+### Added
+
+- **`event.participantIDs` is populated on Instagram message events.** Facebook
+  MQTT events carried the thread's member list, so commands ported from
+  GoatBot-Pro read `event.participantIDs` (`all.js` tags every member, `ban.js`
+  checks membership). Instagram inbox events carry none, so the normalizer now
+  fills it from the participants the client learned from thread introspection
+  (`InstaClient.getThreadParticipantIDs`, fed by the native inbox poller's
+  per-poll snapshot). It stays `undefined` when unknown — the same shape as
+  upstream, so `|| []` guards keep working.
+- **`addUserToGroup` / `removeUserFromGroup` resolve a username or `@handle` to
+  a numeric igid** before calling the endpoint, against the offline user index
+  first and a live lookup second, and return `false` rather than send a
+  non-numeric id Instagram would 4xx on. The frozen `adduser.js` may hand over a
+  handle it could not resolve itself.
+
+### Fixed
+
+- **A username lookup can no longer masquerade as a dead session.** Both
+  `usernameinfo` and `users/search` are `/api/v1` REST paths that Instagram now
+  answers with a 302 to the login page for a web session; the HTTP layer
+  classifies any 3xx as an auth failure, so `getInfoByUsername` (and `search`)
+  used to leak an auth-classified error. They now return `null` / `[]`, letting
+  callers fall back to the users learned from thread introspection.
+- **A command that builds an empty reply no longer risks the session.** An empty
+  text send already returns `{ messageID: null, dropped: "empty" }`; the ported
+  `adduser.js` (now byte-identical to GoatBot-Pro) can produce an empty string
+  for a handle it cannot resolve, and the drop guard keeps that from reaching
+  Instagram's login-page redirect.
+
+## [2.0.9] - 2026-10-11
+
+### Fixed
+
+- **`unsendMessage` still never deleted the message.** The 2.0.8 fix sent
+  `_csrftoken` + `_uuid` to the REST delete endpoint
+  (`/api/v1/direct_v2/threads/<t>/items/<id>/delete/`), but Instagram retired
+  that endpoint: on `www.instagram.com` the whole `/api/v1` namespace now
+  returns `{"message":"useragent mismatch","status":"fail"}` /
+  `not-logged-in` 404, and on `i.instagram.com` it needs the mobile app
+  identity. Unsend now goes through the web DM client's Relay mutation
+  `IGDMessageUnsendDialogOffMsysMutation` (doc_id `26948700068153789`) with
+  `{ message_id, send_data: { thread_id } }`, which answers
+  `{ data: { direct_unsend_message: true } }`. Verified against a real message.
+
 ## [2.0.8] - 2026-10-11
 
 ### Fixed

package/DOCS.md

@@ -182,6 +182,7 @@ Relay **doc_ids** (stable per friendly-name, rotate rarely):
 | `IGDirectCutoutStickerSendMutation` | `26601474479505807` |
 | `PolarisDirectInboxQuery` | `27909866362025854` |
 | `useFeatureLimitsOffMsysQuery` (login probe) | `28374543635529813` |
+| `IGDMessageUnsendDialogOffMsysMutation` (unsend) | `26948700068153789` |
 | Thread detail | `29619996517588618` |
 
 ### Text send
@@ -213,6 +214,21 @@ Relay **doc_ids** (stable per friendly-name, rotate rarely):
 `reaction_status` is `"created"` or `"deleted"`. (Reverse-engineered from the
 live `comet/CometDirectPageWeb` bundle; the legacy REST reaction endpoint 404s.)
 
+### Unsend (delete for everyone)
+
+`IGDMessageUnsendDialogOffMsysMutation` (doc_id `26948700068153789`) with
+variables:
+
+```javascript
+{ message_id: "<mid.$...>", send_data: { thread_id: "<threadID>" } }
+```
+
+It answers `{ data: { direct_unsend_message: true } }`. The legacy REST delete
+endpoint (`/api/v1/direct_v2/threads/<t>/items/<id>/delete/`) is gone: on
+`www.instagram.com` the whole `/api/v1` namespace returns `not-logged-in` 404,
+and on `i.instagram.com` it needs the mobile app identity. (Reverse-engineered
+from the live `IGDMessageUnsendDialogOffMsys.react` chunk.)
+
 ### Session validation
 
 The REST probe endpoints lie (they 302 to login even for healthy sessions), so

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@eryxenx/insta-chat",
-  "version": "2.0.8",
-  "description": " Unofficial Instagram Chat API for Node.js | Build Instagram DM bots on personal accounts \u2014 send messages, media, voice notes, reactions, edit & unsend, listen for incoming chats. No browser at runtime",
+  "version": "2.0.10",
+  "description": " Unofficial Instagram Chat API for Node.js | Build Instagram DM bots on personal accounts — send messages, media, voice notes, reactions, edit & unsend, listen for incoming chats. No browser at runtime",
   "main": "index.js",
   "types": "index.d.ts",
   "exports": {
@@ -23,7 +23,7 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "test": "node test/smoke.js && node test/antiSuspension.test.js && node test/replyContent.test.js && node test/edit.test.js && node test/sendReply.test.js && node test/client.test.js && node test/relayError.test.js && node test/safetyWiring.test.js && node test/mediaOrder.test.js && node test/sessionSafety.test.js && node test/emptySend.test.js && node test/pollFloor.test.js && node test/unsend.test.js",
+    "test": "node test/smoke.js && node test/antiSuspension.test.js && node test/replyContent.test.js && node test/edit.test.js && node test/sendReply.test.js && node test/client.test.js && node test/relayError.test.js && node test/safetyWiring.test.js && node test/mediaOrder.test.js && node test/sessionSafety.test.js && node test/emptySend.test.js && node test/pollFloor.test.js && node test/userLookup.test.js && node test/unsend.test.js && node test/unsendGraphQL.test.js",
     "build": "node scripts/build.js"
   },
   "keywords": [

package/src/app/InstaClient.js

@@ -39,6 +39,10 @@ class InstaClient {
     // lookups (usernameinfo / web_profile_info) for web sessions, so resolving a
     // mentioned @handle must come from data the session already has.
     this._userIndex = new Map();
+    // threadID -> participant igids, learned from thread introspection. Instagram
+    // inbox events carry no participant list, so frozen commands that read
+    // event.participantIDs (all, ban) are served from here by the normalizer.
+    this._threadMembers = new Map();
 
     this._learnFromInbox();
     loadApiMethods(this);
@@ -146,9 +150,25 @@ class InstaClient {
       const users = (t.users || []).slice();
       if (t.viewer) users.unshift(t.viewer);
       for (const u of users) this._rememberUser(u);
+      const threadID = t.id != null ? String(t.id) : t.thread_id != null ? String(t.thread_id) : null;
+      if (threadID) this._threadMembers.set(threadID, users.map((u) => String(u.id || u.pk)).filter(Boolean));
     }
   }
 
+  // The igids of a thread's participants, from data already seen. Prefers the
+  // native poller's latest inbox snapshot (fresh every poll) and falls back to
+  // the thread introspection the FCA layer learned. Used to fill
+  // event.participantIDs for commands ported from Facebook, whose MQTT events
+  // carried the member list but Instagram's do not.
+  getThreadParticipantIDs(threadID) {
+    if (this.api && typeof this.api.getThreadMemberIDs === "function") {
+      const live = this.api.getThreadMemberIDs(threadID);
+      if (live.length) return live;
+    }
+    const members = this._threadMembers.get(String(threadID));
+    return Array.isArray(members) ? members.slice() : [];
+  }
+
   // Indexes one Instagram user record (inbox/thread shape: id, username,
   // full_name, interop_messaging_user_fbid, profile_pic_url) under every key a
   // command may look it up by.
@@ -342,16 +362,44 @@ class InstaClient {
   async changeAvatar() { return false; }
 
   // Instagram group DMs support adding/removing participants. FCA passes
-  // (userID, threadID); the API takes the reverse. Older native clients may not
-  // expose the pair, so degrade to a stub instead of throwing.
+  // (userID, threadID); the API takes the reverse. Instagram's endpoint only
+  // accepts a numeric igid, but frozen commands (adduser.js) may hand over a
+  // username or @handle (they resolve numeric ids themselves; only a handle can
+  // reach here unresolved). Resolve it against data already learned, and refuse
+  // rather than send a non-numeric id the endpoint would 4xx on.
+  async _resolveUserKey(userID) {
+    const key = String(userID).replace(/^@/, "").trim();
+    if (/^\d+$/.test(key)) return key;
+    const known = this.getUserByUsername(key);
+    if (known) {
+      const id = known.id || known.pk || known.interop_messaging_user_fbid;
+      if (id != null) return String(id);
+    }
+    if (typeof this.api.getUserInfoByUsername === "function") {
+      try {
+        const u = await this.api.getUserInfoByUsername(key);
+        if (u) {
+          this._rememberUser(u);
+          const id = u.id || u.pk || u.interop_messaging_user_fbid;
+          if (id != null) return String(id);
+        }
+      } catch (_) {}
+    }
+    return null;
+  }
+
   async addUserToGroup(userID, threadID) {
     if (typeof this.api.addUserToGroup !== "function") return false;
-    return this.api.addUserToGroup(threadID, userID);
+    const uid = await this._resolveUserKey(userID);
+    if (!uid) return false;
+    return this.api.addUserToGroup(threadID, uid);
   }
 
   async removeUserFromGroup(userID, threadID) {
     if (typeof this.api.removeUserFromGroup !== "function") return false;
-    return this.api.removeUserFromGroup(threadID, userID);
+    const uid = await this._resolveUserKey(userID);
+    if (!uid) return false;
+    return this.api.removeUserFromGroup(threadID, uid);
   }
 }
 

package/src/constants.js

@@ -25,7 +25,8 @@ const DOC_ID = {
   CUTOUT_STICKER_SEND: "26601474479505807",
   MARK_THREAD_READ: "27399783383056109",
   THREAD_DETAIL: "29619996517588618",
-  INBOX: "27909866362025854"
+  INBOX: "27909866362025854",
+  UNSEND_MESSAGE: "26948700068153789"
 };
 
 const EP = {

package/src/events/normalizeEvent.js

@@ -93,6 +93,14 @@ class EventNormalizer {
       messageID: String(raw.messageID),
       body,
       senderName,
+      // Facebook MQTT events carried the member list; Instagram's do not. Frozen
+      // commands (all.js, ban.js) read event.participantIDs, so fill it from the
+      // members the client learned from thread introspection. Undefined when
+      // unknown — the same shape as upstream, so `|| []` guards behave.
+      participantIDs:
+        typeof this.client.getThreadParticipantIDs === "function"
+          ? this.client.getThreadParticipantIDs(threadID)
+          : undefined,
       mentions: body.includes("@") ? await this._resolveMentions(body) : {},
       attachments: (raw.attachments || []).map((a) => ({
         type: a.type,

package/src/methods/inbox.js

@@ -35,6 +35,10 @@ class InboxMethods {
     this._seen = new Map();
     this._pollTimer = null;
     this._selfFbid = null;
+    // threadID -> participant igids from the latest inbox snapshot. The inbox
+    // event carries no participant list, so the FCA layer reads it from here to
+    // fill event.participantIDs for commands ported from Facebook (all, ban).
+    this._members = new Map();
     // threadID -> { title, image, members:Set, adminIDs:Set, nicknames:{} }
     this._threadState = new Map();
     this._statePrimed = false;
@@ -58,9 +62,19 @@ class InboxMethods {
       const fbid = t.viewer?.interop_messaging_user_fbid;
       if (fbid && !this._selfFbid) this._selfFbid = String(fbid);
     }
+    for (const t of threads) {
+      const tid = String(t.id || t.thread_id);
+      if (tid) this._members.set(tid, (t.users || []).map((u) => String(u.id || u.pk)).filter(Boolean));
+    }
     return { threads };
   }
 
+  // Participant igids for a thread, from the latest inbox snapshot.
+  getThreadMemberIDs(threadID) {
+    const members = this._members.get(String(threadID));
+    return Array.isArray(members) ? members.slice() : [];
+  }
+
   // The Polaris inbox returns messages under thread.slide_messages as a Relay
   // connection ({ edges: [{ node }] }); the node carries sender_fbid,
   // content_type, text_body and content. Older captures used thread.items, so

package/src/methods/message.js

@@ -99,15 +99,24 @@ class MessageMethods {
     });
   }
 
-  // Instagram's REST delete requires the request to look like the web client's:
-  // a `_csrftoken` (the csrftoken cookie) and a `_uuid` (the browser/device id).
-  // An empty body is rejected — Instagram answers with `status: "fail"` (or a
-  // 404/redirect), which made `unsend` a silent no-op.
+  // Unsend (delete for everyone) via the Relay mutation the web DM client uses:
+  // `IGDMessageUnsendDialogOffMsysMutation` (doc_id 26948700068153789). The
+  // legacy REST delete path (`/direct_v2/threads/<t>/items/<id>/delete/`) is
+  // dead on www.instagram.com (the whole /api/v1 namespace 404s) and on
+  // i.instagram.com it needs the mobile app identity, so we go straight to
+  // GraphQL. Captured live; verified against a real message.
   async unsend(threadID, itemID) {
-    const csrf = this.http.getCookie("csrftoken");
-    const body = { _csrftoken: csrf, _uuid: this.identity?.uuid || this.http.uuid() };
-    const res = await this.http.postForm(EP.ITEM_DELETE(threadID, itemID), body);
-    return res?.status === "ok";
+    try {
+      const res = await this.http.postGraphQL(
+        "IGDMessageUnsendDialogOffMsysMutation",
+        DOC_ID.UNSEND_MESSAGE,
+        { message_id: String(itemID), send_data: { thread_id: String(threadID) } },
+        `https://www.instagram.com/direct/t/${threadID}/`
+      );
+      return Boolean(res && res.data && res.data.direct_unsend_message) && !res.errors;
+    } catch (_) {
+      return false;
+    }
   }
 
   // Instagram lets you edit an outgoing DM within 15 minutes of sending it.

package/src/methods/user.js

@@ -18,21 +18,35 @@ class UserMethods {
   }
 
   async getInfoByUsername(username) {
+    // Both endpoints are mobile/web REST paths under /api/v1, which Instagram
+    // now answers with a 302 to the login page for a web session (the HTTP
+    // layer classifies any 3xx as an auth failure). A username lookup must not
+    // leak an auth-classified error — a command reading a handle would then look
+    // like a dead session. Return null instead; callers fall back to the users
+    // the client already learned from thread introspection.
     try {
       const res = await this.http.get(EP.USER_BY_USERNAME(username));
       if (res?.user) return res.user;
     } catch (_) {}
 
-    const res = await this.http.get(EP.USER_SEARCH(username, 30));
-    const match = (res?.users || []).find(
-      (u) => u.username?.toLowerCase() === username.toLowerCase()
-    );
-    return match || null;
+    try {
+      const res = await this.http.get(EP.USER_SEARCH(username, 30));
+      const match = (res?.users || []).find(
+        (u) => u.username?.toLowerCase() === username.toLowerCase()
+      );
+      return match || null;
+    } catch (_) {
+      return null;
+    }
   }
 
   async search(query, limit = 20) {
-    const res = await this.http.get(EP.USER_SEARCH(query, limit));
-    return res?.users || [];
+    try {
+      const res = await this.http.get(EP.USER_SEARCH(query, limit));
+      return res?.users || [];
+    } catch (_) {
+      return [];
+    }
   }
 }