[OlegNickeshin]

Plugin type (required)

• UI Plugin — the hosted MCP exposes a Telegram photo-viewing resource through _meta.ui.resourceUri.
• Standard plugin
• Not applicable

Affected plugin name: lemma-telepath. This describes the existing hosted photo widget; this refresh adds no UI or tools.

What this adds

Telepath connects a person's own Telegram account to ZCode over a hosted MCP server: full-text search across their chat archive, reading the documents, photos and transcribed voice inside it, and replying as themselves.

It is not another channel for talking to an assistant through Telegram — it gives the assistant the conversations the user already has.

It runs on Telegram's official business-bot API, a bot the user adds under Settings → My Account → Chat automation. That entry is open to every account — no Telegram Premium. No MTProto user session is involved.

Registration

• plugins/lemma-telepath/ — .zcode-plugin/plugin.json, .mcp.json, README.md, README_CN.md
• Registered in marketplace.json, category productivity, version 0.1.0 in both files
• description_i18n (en + zh-CN) identical in the manifest and the marketplace entry

How it was tested

Installed and exercised in ZCode 3.14.4 (Linux x64) from a local marketplace:

1. Added the local directory in Settings → Plugin management → Discover, installed and enabled the plugin.
2. ZCode registered the remote server as plugin:lemma-telepath:telepath and performed dynamic client registration against our OAuth server — confirmed server-side, with a loopback redirect at 127.0.0.1.
3. Pressed Open authorization, signed in with Telegram in the browser; access and refresh tokens were issued with scopes telegram.read telegram.write.
4. Asked "What are my most recent Telegram chats?" — the tools returned the real chat list with per-chat message counts.

python3 scripts/validate.py → OK: 27 plugin(s) validated. python3 scripts/build_dist.py → builds plugins/lemma-telepath/0.1.0/plugin.zip. git diff --check → clean.

Dependencies, network, permissions, side effects

The package ships no code — manifests and documentation only. No hooks, commands, skills, agents, postinstall, downloaded executables or local file writes. Every request goes to one domain:

Endpoint	Why
https://telepath.lemma.company/mcp	the MCP server (streamable HTTP)
/authorize, /token, /register	OAuth 2.1 with PKCE and dynamic client registration
/oauth/login	sign-in page using Telegram OpenID Connect

Side effects are real. With the send capability left on, a tool call sends or edits a message to an actual person; Telegram permits this only in private chats that received an incoming message within the last 24 hours. Voice transcription is optional and paid — audio goes to Mistral (Voxtral, EU), not reused for training, no copy kept once the transcript is stored. Group archiving, history import and bringing your own bot are optional and off by default. All of it is switchable, and /deletedata erases everything.

The hosted service is not end-to-end encrypted, and both READMEs say so plainly rather than implying otherwise. Each account gets a physically separate database; the disk is LUKS-encrypted at rest.

Licensing and provenance

Plugin package is MIT — Lemma-Company/telepath-plugin. Manifests and docs only; none of the server's code is in it. The hosted service is operated by Lemma under its published terms. No third-party code or assets are vendored. Not affiliated with Telegram or Z.ai.

Checklist

• name unique and kebab-case
• required files and both language READMEs present
• category correct (productivity)
• no secrets, private data or machine-specific paths
• validate.py, build_dist.py, git diff --check pass

🤖 Generated with Claude Code

Refresh verification — 2026-10-22

• Rebased onto upstream ded8021; resolved the shared marketplace.json conflict.
• All four files in plugins/lemma-telepath/ are byte-for-byte identical to the original submission. Version remains 0.1.0; no installable-content change.
• Every existing upstream marketplace entry is preserved.
• pnpm install --frozen-lockfile — passed using Node 24 and pnpm 10.33.2.
• python3 scripts/validate.py — passed: 47 plugins.
• git diff --check — passed.
• Telepath's own ZIP built successfully with the repository's build_dist.build_zip; all four packaged files match the original submission.
• Full pnpm build could not complete on this machine: the unrelated upstream PhotoCraft build requires rustup. Full python3 scripts/build_dist.py consequently stops on PhotoCraft's missing build output. Those build scripts and UI plugin sources are unchanged from upstream.
• The ZCode 3.14.4 runtime test above is the original submission test; it was not rerun for this rebase.

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; once merged it is published to the marketplace and this PR is closed automatically.

[panda920]

❌ Internal validation failed:

lemma-telepath: external submissions must use ./external_plugins/lemma-telepath

Please fix it and push again; the check re-runs automatically.

🤖 Copy this prompt into Claude Code / Codex to fix it

You are updating my pull request #65 to github.com/zai-org/zcode-plugins (the ZCode plugin marketplace).
The maintainers' automated intake reported: `python scripts/validate.py` failed

Validator output:
lemma-telepath: external submissions must use ./external_plugins/lemma-telepath

Fix it in this repository:
- New external plugins belong under external_plugins/<my-plugin>/; keep existing plugins in their current directory;
  never modify .github/, scripts/, tests/, .gitignore, .gitattributes or AGENTS.md.
- Follow CONTRIBUTING.md and AGENTS.md: the manifest lives at <plugin-directory>/.zcode-plugin/plugin.json,
  its name/version must match marketplace.json, names are kebab-case, keep the required i18n fields.
- Fetch the latest main of zai-org/zcode-plugins and rebase onto it; if marketplace.json conflicts,
  keep every existing entry and re-add mine.
- Run `python scripts/validate.py` until it passes, then force-push my PR branch.