@eryxenx/insta-chat 2.0.9 → 2.0.10

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to `@eryxenx/insta-chat` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/) and uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.0.10] - 2026-10-11
+
+### Added
+
+- **`event.participantIDs` is populated on Instagram message events.** Facebook
+  MQTT events carried the thread's member list, so commands ported from
+  GoatBot-Pro read `event.participantIDs` (`all.js` tags every member, `ban.js`
+  checks membership). Instagram inbox events carry none, so the normalizer now
+  fills it from the participants the client learned from thread introspection
+  (`InstaClient.getThreadParticipantIDs`, fed by the native inbox poller's
+  per-poll snapshot). It stays `undefined` when unknown — the same shape as
+  upstream, so `|| []` guards keep working.
+- **`addUserToGroup` / `removeUserFromGroup` resolve a username or `@handle` to
+  a numeric igid** before calling the endpoint, against the offline user index
+  first and a live lookup second, and return `false` rather than send a
+  non-numeric id Instagram would 4xx on. The frozen `adduser.js` may hand over a
+  handle it could not resolve itself.
+
+### Fixed
+
+- **A username lookup can no longer masquerade as a dead session.** Both
+  `usernameinfo` and `users/search` are `/api/v1` REST paths that Instagram now
+  answers with a 302 to the login page for a web session; the HTTP layer
+  classifies any 3xx as an auth failure, so `getInfoByUsername` (and `search`)
+  used to leak an auth-classified error. They now return `null` / `[]`, letting
+  callers fall back to the users learned from thread introspection.
+- **A command that builds an empty reply no longer risks the session.** An empty
+  text send already returns `{ messageID: null, dropped: "empty" }`; the ported
+  `adduser.js` (now byte-identical to GoatBot-Pro) can produce an empty string
+  for a handle it cannot resolve, and the drop guard keeps that from reaching
+  Instagram's login-page redirect.
+
 ## [2.0.9] - 2026-10-11
 
 ### Fixed

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@eryxenx/insta-chat",
-  "version": "2.0.9",
-  "description": " Unofficial Instagram Chat API for Node.js | Build Instagram DM bots on personal accounts \u2014 send messages, media, voice notes, reactions, edit & unsend, listen for incoming chats. No browser at runtime",
+  "version": "2.0.10",
+  "description": " Unofficial Instagram Chat API for Node.js | Build Instagram DM bots on personal accounts — send messages, media, voice notes, reactions, edit & unsend, listen for incoming chats. No browser at runtime",
   "main": "index.js",
   "types": "index.d.ts",
   "exports": {
@@ -23,7 +23,7 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "test": "node test/smoke.js && node test/antiSuspension.test.js && node test/replyContent.test.js && node test/edit.test.js && node test/sendReply.test.js && node test/client.test.js && node test/relayError.test.js && node test/safetyWiring.test.js && node test/mediaOrder.test.js && node test/sessionSafety.test.js && node test/emptySend.test.js && node test/pollFloor.test.js && node test/unsend.test.js && node test/unsendGraphQL.test.js",
+    "test": "node test/smoke.js && node test/antiSuspension.test.js && node test/replyContent.test.js && node test/edit.test.js && node test/sendReply.test.js && node test/client.test.js && node test/relayError.test.js && node test/safetyWiring.test.js && node test/mediaOrder.test.js && node test/sessionSafety.test.js && node test/emptySend.test.js && node test/pollFloor.test.js && node test/userLookup.test.js && node test/unsend.test.js && node test/unsendGraphQL.test.js",
     "build": "node scripts/build.js"
   },
   "keywords": [

package/src/app/InstaClient.js

@@ -39,6 +39,10 @@ class InstaClient {
     // lookups (usernameinfo / web_profile_info) for web sessions, so resolving a
     // mentioned @handle must come from data the session already has.
     this._userIndex = new Map();
+    // threadID -> participant igids, learned from thread introspection. Instagram
+    // inbox events carry no participant list, so frozen commands that read
+    // event.participantIDs (all, ban) are served from here by the normalizer.
+    this._threadMembers = new Map();
 
     this._learnFromInbox();
     loadApiMethods(this);
@@ -146,9 +150,25 @@ class InstaClient {
       const users = (t.users || []).slice();
       if (t.viewer) users.unshift(t.viewer);
       for (const u of users) this._rememberUser(u);
+      const threadID = t.id != null ? String(t.id) : t.thread_id != null ? String(t.thread_id) : null;
+      if (threadID) this._threadMembers.set(threadID, users.map((u) => String(u.id || u.pk)).filter(Boolean));
     }
   }
 
+  // The igids of a thread's participants, from data already seen. Prefers the
+  // native poller's latest inbox snapshot (fresh every poll) and falls back to
+  // the thread introspection the FCA layer learned. Used to fill
+  // event.participantIDs for commands ported from Facebook, whose MQTT events
+  // carried the member list but Instagram's do not.
+  getThreadParticipantIDs(threadID) {
+    if (this.api && typeof this.api.getThreadMemberIDs === "function") {
+      const live = this.api.getThreadMemberIDs(threadID);
+      if (live.length) return live;
+    }
+    const members = this._threadMembers.get(String(threadID));
+    return Array.isArray(members) ? members.slice() : [];
+  }
+
   // Indexes one Instagram user record (inbox/thread shape: id, username,
   // full_name, interop_messaging_user_fbid, profile_pic_url) under every key a
   // command may look it up by.
@@ -342,16 +362,44 @@ class InstaClient {
   async changeAvatar() { return false; }
 
   // Instagram group DMs support adding/removing participants. FCA passes
-  // (userID, threadID); the API takes the reverse. Older native clients may not
-  // expose the pair, so degrade to a stub instead of throwing.
+  // (userID, threadID); the API takes the reverse. Instagram's endpoint only
+  // accepts a numeric igid, but frozen commands (adduser.js) may hand over a
+  // username or @handle (they resolve numeric ids themselves; only a handle can
+  // reach here unresolved). Resolve it against data already learned, and refuse
+  // rather than send a non-numeric id the endpoint would 4xx on.
+  async _resolveUserKey(userID) {
+    const key = String(userID).replace(/^@/, "").trim();
+    if (/^\d+$/.test(key)) return key;
+    const known = this.getUserByUsername(key);
+    if (known) {
+      const id = known.id || known.pk || known.interop_messaging_user_fbid;
+      if (id != null) return String(id);
+    }
+    if (typeof this.api.getUserInfoByUsername === "function") {
+      try {
+        const u = await this.api.getUserInfoByUsername(key);
+        if (u) {
+          this._rememberUser(u);
+          const id = u.id || u.pk || u.interop_messaging_user_fbid;
+          if (id != null) return String(id);
+        }
+      } catch (_) {}
+    }
+    return null;
+  }
+
   async addUserToGroup(userID, threadID) {
     if (typeof this.api.addUserToGroup !== "function") return false;
-    return this.api.addUserToGroup(threadID, userID);
+    const uid = await this._resolveUserKey(userID);
+    if (!uid) return false;
+    return this.api.addUserToGroup(threadID, uid);
   }
 
   async removeUserFromGroup(userID, threadID) {
     if (typeof this.api.removeUserFromGroup !== "function") return false;
-    return this.api.removeUserFromGroup(threadID, userID);
+    const uid = await this._resolveUserKey(userID);
+    if (!uid) return false;
+    return this.api.removeUserFromGroup(threadID, uid);
   }
 }
 

package/src/events/normalizeEvent.js

@@ -93,6 +93,14 @@ class EventNormalizer {
       messageID: String(raw.messageID),
       body,
       senderName,
+      // Facebook MQTT events carried the member list; Instagram's do not. Frozen
+      // commands (all.js, ban.js) read event.participantIDs, so fill it from the
+      // members the client learned from thread introspection. Undefined when
+      // unknown — the same shape as upstream, so `|| []` guards behave.
+      participantIDs:
+        typeof this.client.getThreadParticipantIDs === "function"
+          ? this.client.getThreadParticipantIDs(threadID)
+          : undefined,
       mentions: body.includes("@") ? await this._resolveMentions(body) : {},
       attachments: (raw.attachments || []).map((a) => ({
         type: a.type,

package/src/methods/inbox.js

@@ -35,6 +35,10 @@ class InboxMethods {
     this._seen = new Map();
     this._pollTimer = null;
     this._selfFbid = null;
+    // threadID -> participant igids from the latest inbox snapshot. The inbox
+    // event carries no participant list, so the FCA layer reads it from here to
+    // fill event.participantIDs for commands ported from Facebook (all, ban).
+    this._members = new Map();
     // threadID -> { title, image, members:Set, adminIDs:Set, nicknames:{} }
     this._threadState = new Map();
     this._statePrimed = false;
@@ -58,9 +62,19 @@ class InboxMethods {
       const fbid = t.viewer?.interop_messaging_user_fbid;
       if (fbid && !this._selfFbid) this._selfFbid = String(fbid);
     }
+    for (const t of threads) {
+      const tid = String(t.id || t.thread_id);
+      if (tid) this._members.set(tid, (t.users || []).map((u) => String(u.id || u.pk)).filter(Boolean));
+    }
     return { threads };
   }
 
+  // Participant igids for a thread, from the latest inbox snapshot.
+  getThreadMemberIDs(threadID) {
+    const members = this._members.get(String(threadID));
+    return Array.isArray(members) ? members.slice() : [];
+  }
+
   // The Polaris inbox returns messages under thread.slide_messages as a Relay
   // connection ({ edges: [{ node }] }); the node carries sender_fbid,
   // content_type, text_body and content. Older captures used thread.items, so

package/src/methods/user.js

@@ -18,21 +18,35 @@ class UserMethods {
   }
 
   async getInfoByUsername(username) {
+    // Both endpoints are mobile/web REST paths under /api/v1, which Instagram
+    // now answers with a 302 to the login page for a web session (the HTTP
+    // layer classifies any 3xx as an auth failure). A username lookup must not
+    // leak an auth-classified error — a command reading a handle would then look
+    // like a dead session. Return null instead; callers fall back to the users
+    // the client already learned from thread introspection.
     try {
       const res = await this.http.get(EP.USER_BY_USERNAME(username));
       if (res?.user) return res.user;
     } catch (_) {}
 
-    const res = await this.http.get(EP.USER_SEARCH(username, 30));
-    const match = (res?.users || []).find(
-      (u) => u.username?.toLowerCase() === username.toLowerCase()
-    );
-    return match || null;
+    try {
+      const res = await this.http.get(EP.USER_SEARCH(username, 30));
+      const match = (res?.users || []).find(
+        (u) => u.username?.toLowerCase() === username.toLowerCase()
+      );
+      return match || null;
+    } catch (_) {
+      return null;
+    }
   }
 
   async search(query, limit = 20) {
-    const res = await this.http.get(EP.USER_SEARCH(query, limit));
-    return res?.users || [];
+    try {
+      const res = await this.http.get(EP.USER_SEARCH(query, limit));
+      return res?.users || [];
+    } catch (_) {
+      return [];
+    }
   }
 }