feat(billing): Chargebee invoicing + PayPal wallet as agent tools (#788, #789, #527)

.github/workflows/ci.yml

@@ -741,6 +741,27 @@ jobs:
           cargo test --locked --features acp --lib server::acp
           cargo test --locked --features acp --lib harness::acp_run_turn
 
+      # Issue #788: Chargebee billing — the REST layer (`chargebee::`) and the
+      # toolbelt bridge (`harness::chargebee`) in one filter, which selects both.
+      # It runs HERE rather than on the fast default job because the bridge lives
+      # under `src/harness/` and so compiles only with `openhuman`; splitting it
+      # across two lanes would need two rows in feature-lanes.txt for one
+      # feature, which that table rejects. All of it is offline: the wire tests
+      # drive a stub on an ephemeral port and the rest never build a request.
+      - name: Test the Chargebee billing integration
+        run: scripts/ci/run-scoped-suite.sh "chargebee" openhuman,tinycortex,chargebee chargebee
+
+      # Issue #789: PayPal. Here rather than on the fast default job for the same
+      # reason as chargebee above — the toolbelt bridge is under `src/harness/`
+      # and so needs `openhuman`. It USED to ride the default job on `--features
+      # paypal` alone, which reached `company::paypal` and `paypal::` and could
+      # not compile `harness::paypal` at all: those tests existed and no lane ran
+      # them, which is exactly the #770 pathology this table exists to stop. One
+      # lane with the gated feature set selects all three. Offline: the token
+      # cache and error tests drive a stub on an ephemeral port.
+      - name: Test the PayPal integration
+        run: scripts/ci/run-scoped-suite.sh "paypal" openhuman,tinycortex,paypal paypal
+
       - name: Assert every integration target actually runs
         run: scripts/ci/assert-integration-targets-run.sh openhuman,tinycortex
 

.github/workflows/deploy-staging.yml

@@ -66,7 +66,7 @@ env:
   # medulla (hosted brain transport), tinycortex (local memory backend), and
   # sidecar. `sqlite` is intentionally omitted — its bundled rusqlite needs a C
   # compiler the slim build image lacks, and it is redundant on a mongodb tenant.
-  TENANT_FEATURES: mongodb,openhuman,openhuman-rpc,tinyplace,github,smtp,dns,tinyhumans,webhooks,platform-jwt,export,mcp,media,composio,imap,telegram,medulla,tinycortex,sidecar
+  TENANT_FEATURES: mongodb,openhuman,openhuman-rpc,tinyplace,github,smtp,dns,tinyhumans,webhooks,platform-jwt,export,mcp,media,composio,imap,telegram,medulla,tinycortex,sidecar,chargebee,paypal
 
 jobs:
   deploy:

Cargo.toml

@@ -405,6 +405,16 @@ telegram = ["dep:reqwest"]
 # read-only connections catalog compiles without this; only the token-exchanging
 # write routes are gated here (they need the shared `reqwest` client).
 oauth = ["dep:reqwest"]
+# Issue #788: Chargebee billing integrated as backend service code, surfaced to
+# agents as callable tools. NOT a separate MCP server and NOT a second binary —
+# the integration lives in the tenant workload so the credential can be
+# per-company, held in that company's own SecretStore. The only gated dependency
+# is the shared `reqwest` client the REST calls use; `src/chargebee/` compiles
+# only under this feature, so the default build is unaffected.
+chargebee = ["dep:reqwest"]
+# Issue #789: PayPal wallet + transaction reads, same shape as `chargebee`
+# above — backend service code, per-company credentials, only `reqwest` gated.
+paypal = ["dep:reqwest"]
 
 [patch.crates-io]
 # opencompany's own vendored tinyagents (2.1.0). Satisfies openhuman's `^2.1`.

companies/openhuman_demo/agents/ceo.toml

@@ -6,4 +6,4 @@ description = "Sets direction, answers about the company, and delegates the work
 tier = "orchestrator"
 # `workspace.read` is read-only by design: writes need a bare `workspace` or an
 # explicit `workspace.write`, so this cannot silently overwrite operator notes.
-tools = ["mcp:*", "workspace.read"]
+tools = ["mcp:*", "workspace.read", "chargebee", "paypal"]

companies/openhuman_demo/company.toml

@@ -31,7 +31,7 @@ mode = "full"
 # Both forms are needed: this list is matched with exact/glob semantics, so bare
 # `workspace` covers an agent asking for `workspace` but NOT one asking for
 # `workspace.read`, and `workspace.*` covers the sub-grants but not the bare one.
-allow = ["mcp:*", "workspace", "workspace.*"]
+allow = ["mcp:*", "workspace", "workspace.*", "chargebee", "paypal"]
 
 # Desks (group chats) the orchestrator can hand a turn to. Each desk's first
 # member is its lead; `delegate_to_desk` runs that member's turn.

examples/live_company_turn.rs

@@ -137,6 +137,10 @@ async fn main() -> anyhow::Result<()> {
         plan: None,
         media: None,
         composio: None,
+        #[cfg(feature = "chargebee")]
+        chargebee: None,
+        #[cfg(feature = "paypal")]
+        paypal: None,
         steer: opencompany::company::steer::InflightRegistry::default(),
         run_supervisor: opencompany::runtime::RunSupervisor::default(),
         delivery: None,

frontend/src/api/billing.ts

@@ -0,0 +1,121 @@
+// The Chargebee billing configuration API (issue #788, UI tracked in #527).
+//
+// Credentials are write-only: the API key and the webhook credential are sent
+// on save and stored in the host's secret store; neither is ever returned. The
+// read shape carries booleans and the (non-secret) site identifier only, so
+// there is no field on this type that could leak a key into a rendered page.
+//
+// Standalone functions over the shared client, mirroring `api/mcp.ts` and
+// `api/skills.ts`, so `OpenCompanyClient` needs no new methods.
+
+import type { OpenCompanyClient } from "./client";
+
+/**
+ * The non-secret view of a company's Chargebee configuration.
+ *
+ * Four separate flags rather than one `connected`, because they fail
+ * differently and a single boolean sends an operator to the wrong place for
+ * three of them — see `BillingView` for how each is worded.
+ */
+export interface BillingStatus {
+  /** Whether an API key is stored. Never the key. */
+  apiKeyConfigured: boolean;
+  /** The Chargebee site slug, e.g. `acme-test`. Not secret. */
+  site: string | null;
+  /** Whether a webhook credential is stored. */
+  webhookConfigured: boolean;
+  /** The URL to paste into Chargebee, or null on a host with no public URL. */
+  webhookUrl: string | null;
+  /** Whether the company's manifest explicitly grants `chargebee`. */
+  granted: boolean;
+  /** Whether the `chargebee` feature is compiled into the running host. */
+  inBuild: boolean;
+}
+
+/** The write-only save body. Omitted fields keep their stored value. */
+export interface BillingConfig {
+  /** Write-only. Omit to leave the stored key unchanged. */
+  apiKey?: string;
+  /** The site identifier; accepts a bare slug, a host, or a full URL. */
+  site?: string;
+  /** Write-only `username:password` pair. Omit to leave it unchanged. */
+  webhookSecret?: string;
+}
+
+/** Reads the company's Chargebee configuration status. */
+export async function getBilling(
+  client: OpenCompanyClient,
+  company: string | null,
+): Promise<BillingStatus> {
+  return client.get<BillingStatus>(`${client.scopeFor(company)}/billing/chargebee`);
+}
+
+/**
+ * Saves whatever is supplied, and returns the resulting status.
+ *
+ * A patch, not a replace: the host applies only the fields present and
+ * non-empty, so correcting the site never means re-typing the API key — which
+ * an operator cannot do anyway, since it is never shown back to them.
+ */
+export async function saveBilling(
+  client: OpenCompanyClient,
+  company: string | null,
+  config: BillingConfig,
+): Promise<BillingStatus> {
+  return client.put<BillingStatus>(`${client.scopeFor(company)}/billing/chargebee`, config);
+}
+
+/** Clears every stored Chargebee credential. */
+export async function clearBilling(
+  client: OpenCompanyClient,
+  company: string | null,
+): Promise<BillingStatus> {
+  return client.del<BillingStatus>(`${client.scopeFor(company)}/billing/chargebee/key`);
+}
+
+/** The non-secret view of a company's PayPal connection (issue #789). */
+export interface PaypalStatus {
+  /** Whether a client id is stored. Never the id. */
+  clientIdConfigured: boolean;
+  /** Whether a client secret is stored. */
+  clientSecretConfigured: boolean;
+  /** `sandbox` or `live` — which PayPal world the credentials belong to. */
+  environment: string;
+  /** Whether the company's manifest explicitly grants `paypal`. */
+  granted: boolean;
+  /** Whether the `paypal` feature is compiled into the running host. */
+  inBuild: boolean;
+}
+
+/** The write-only PayPal save body. Omitted fields keep their stored value. */
+export interface PaypalConfig {
+  clientId?: string;
+  clientSecret?: string;
+  /** `sandbox` or `live`; anything else is stored as `sandbox`. */
+  environment?: string;
+}
+
+/** Reads the company's PayPal configuration status. */
+export async function getPaypal(
+  client: OpenCompanyClient,
+  company: string | null,
+): Promise<PaypalStatus> {
+  return client.get<PaypalStatus>(`${client.scopeFor(company)}/billing/paypal`);
+}
+
+/** Saves whatever is supplied, and returns the resulting status. */
+export async function savePaypal(
+  client: OpenCompanyClient,
+  company: string | null,
+  config: PaypalConfig,
+): Promise<PaypalStatus> {
+  return client.put<PaypalStatus>(`${client.scopeFor(company)}/billing/paypal`, config);
+}
+
+/** Clears the stored PayPal credentials and resets the environment. */
+export async function clearPaypal(
+  client: OpenCompanyClient,
+  company: string | null,
+): Promise<PaypalStatus> {
+  return client.del<PaypalStatus>(`${client.scopeFor(company)}/billing/paypal/key`);
+}

frontend/src/lib/language.ts

@@ -150,6 +150,10 @@ const TOOL_LABELS: Readonly<Record<string, string>> = {
   // does not exist. Two permissions both reading "Use one of its tools" would be
   // indistinguishable, so the tools that can actually hold one (the catch-all
   // `Other` group) need real words rather than the generic fallback.
+  // Billing (issues #788, #789). Only the two that park need words here; the
+  // read tools never reach an approval card.
+  chargebee_send_invoice: "Send an invoice to a customer",
+  chargebee_create_customer: "Add a customer to Chargebee",
   workspace_write: "Edit a note in its workspace",
   workspace_read: "Read a note in its workspace",
   workspace_list: "List its workspace notes",