refactor(web): improve type safety by replacing any types

Replace unsafe 'any' types with proper TypeScript interfaces:
- Add web/src/llm-api/types.ts with ChatCompletionRequestBody,
  ChatMessage, CodebuffMetadata, and OpenRouter response types
- Fix app/api/v1/_helpers.ts: define UserInfo interface
- Fix app/api/v1/chat/completions/_post.ts: use typed body
- Fix llm-api/openrouter.ts: proper parameter and response types
- Fix llm-api/openai.ts: remove unnecessary type assertions
- Fix llm-api/helpers.ts: use proper types for body access
- Fix util/logger.ts: use LogData/LogArgs types instead of any
- Fix server/agents-transform.ts: define AgentData interface
- Fix error handling in stripe webhook and sessions routes

Author: brandonkachen

web/src/app/api/sessions/route.ts

@@ -73,7 +73,7 @@ async function revokeStandardSessions(
           eq(schema.session.userId, userId),
           inArray(schema.session.sessionToken, tokensToDelete),
           // Explicitly restrict to web/cli to avoid PATs here
-          inArray(schema.session.type, ['web', 'cli'] as any),
+          inArray(schema.session.type, ['web', 'cli'] as const),
         ),
       )
       .returning({ sessionToken: schema.session.sessionToken })
@@ -109,12 +109,13 @@ export async function DELETE(req: NextRequest) {
       return new NextResponse('Unauthorized', { status: 401 })
     }
 
-    const {
-      sessionIds,
-      tokenIds,
-    }: { sessionIds?: string[]; tokenIds?: string[] } = await req
-      .json()
-      .catch(() => ({}) as any)
+    let body: { sessionIds?: string[]; tokenIds?: string[] } = {}
+    try {
+      body = await req.json()
+    } catch {
+      body = {}
+    }
+    const { sessionIds, tokenIds } = body
 
     const userId = session.user.id
 
@@ -137,11 +138,13 @@ export async function DELETE(req: NextRequest) {
     }
 
     return NextResponse.json({ revokedSessions, revokedTokens })
-  } catch (e: any) {
+  } catch (e: unknown) {
+    const errorMessage = e instanceof Error ? e.message : String(e)
+    const stack = e instanceof Error ? e.stack : undefined
     logger.error(
-      { error: e?.message ?? String(e), stack: e?.stack },
+      { error: errorMessage, stack },
       'Error in DELETE /api/sessions',
     )
-    return new NextResponse(e?.message ?? 'Internal error', { status: 500 })
+    return new NextResponse(errorMessage, { status: 500 })
   }
 }

web/src/app/api/stripe/webhook/route.ts

@@ -336,13 +336,13 @@ const webhookHandler = async (req: NextRequest): Promise<NextResponse> => {
       env.STRIPE_WEBHOOK_SECRET_KEY,
     )
   } catch (err) {
-    const error = err as Error
+    const errorMessage = err instanceof Error ? err.message : String(err)
     logger.error(
-      { error: error.message },
+      { error: errorMessage },
       'Webhook signature verification failed',
     )
     return NextResponse.json(
-      { error: { message: `Webhook Error: ${error.message}` } },
+      { error: { message: `Webhook Error: ${errorMessage}` } },
       { status: 400 },
     )
   }
@@ -550,13 +550,13 @@ const webhookHandler = async (req: NextRequest): Promise<NextResponse> => {
     }
     return NextResponse.json({ received: true })
   } catch (err) {
-    const error = err as Error
+    const errorMessage = err instanceof Error ? err.message : String(err)
     logger.error(
-      { error: error.message, eventType: event.type },
+      { error: errorMessage, eventType: event.type },
       'Error processing webhook',
     )
     return NextResponse.json(
-      { error: { message: `Webhook handler error: ${error.message}` } },
+      { error: { message: `Webhook handler error: ${errorMessage}` } },
       { status: 500 },
     )
   }

web/src/app/api/v1/_helpers.ts

@@ -17,6 +17,18 @@ import type { ZodType } from 'zod'
 
 import { extractApiKeyFromHeader } from '@/util/auth'
 
+/**
+ * User information returned from API key validation
+ */
+export interface UserInfo {
+  id: string
+  email: string
+  discord_id: string | null
+  referral_code?: string | null
+  stripe_customer_id?: string | null
+  banned?: boolean
+}
+
 export type HandlerResult<T> =
   | { ok: true; data: T }
   | { ok: false; response: NextResponse }
@@ -77,7 +89,7 @@ export const requireUserFromApiKey = async (params: {
   trackEvent: TrackEventFn
   authErrorEvent: AnalyticsEvent
 }): Promise<
-  HandlerResult<{ userId: string; userInfo: any; logger: Logger }>
+  HandlerResult<{ userId: string; userInfo: UserInfo; logger: Logger }>
 > => {
   const {
     req,

web/src/app/api/v1/chat/completions/_post.ts

@@ -19,6 +19,8 @@ import type {
 } from '@codebuff/common/types/contracts/logger'
 import type { NextRequest } from 'next/server'
 
+import type { ChatCompletionRequestBody } from '@/llm-api/types'
+
 import {
   handleOpenAINonStream,
   OPENAI_SUPPORTED_MODELS,
@@ -109,8 +111,9 @@ export async function postChatCompletions(params: {
       )
     }
 
-    const bodyStream = 'stream' in body && body.stream
-    const runId = (body as any)?.codebuff_metadata?.run_id
+    const typedBody = body as unknown as ChatCompletionRequestBody
+    const bodyStream = typedBody.stream ?? false
+    const runId = typedBody.codebuff_metadata?.run_id
 
     // Extract and validate API key
     const apiKey = extractApiKeyFromHeader(req)
@@ -204,8 +207,7 @@ export async function postChatCompletions(params: {
     }
 
     // Extract and validate agent run ID
-    const runIdFromBody: string | undefined = (body as any).codebuff_metadata
-      ?.run_id
+    const runIdFromBody = typedBody.codebuff_metadata?.run_id
     if (!runIdFromBody || typeof runIdFromBody !== 'string') {
       trackEvent({
         event: AnalyticsEvent.CHAT_COMPLETIONS_VALIDATION_ERROR,
@@ -269,7 +271,7 @@ export async function postChatCompletions(params: {
       if (bodyStream) {
         // Streaming request
         const stream = await handleOpenRouterStream({
-          body,
+          body: typedBody,
           userId,
           stripeCustomerId,
           agentId,
@@ -299,21 +301,20 @@ export async function postChatCompletions(params: {
         })
       } else {
         // Non-streaming request
-        const model = (body as any)?.model
-        const shortModelName =
-          typeof model === 'string' ? model.split('/')[1] : undefined
+        const model = typedBody.model
+        const modelParts = model.split('/')
+        const shortModelName = modelParts.length > 1 ? modelParts[1] : model
         const isOpenAIDirectModel =
-          typeof model === 'string' &&
           model.startsWith('openai/') &&
-          OPENAI_SUPPORTED_MODELS.includes(shortModelName as any)
+          (OPENAI_SUPPORTED_MODELS as readonly string[]).includes(shortModelName)
         // Only use OpenAI endpoint for OpenAI models with n parameter
         // All other models (including non-OpenAI with n parameter) should use OpenRouter
         const shouldUseOpenAIEndpoint =
-          isOpenAIDirectModel && (body as any)?.codebuff_metadata?.n
+          isOpenAIDirectModel && typedBody.codebuff_metadata?.n !== undefined
 
         const nonStreamRequest = shouldUseOpenAIEndpoint
           ? handleOpenAINonStream({
-              body,
+              body: typedBody,
               userId,
               stripeCustomerId,
               agentId,
@@ -322,7 +323,7 @@ export async function postChatCompletions(params: {
               insertMessageBigquery,
             })
           : handleOpenRouterNonStream({
-              body,
+              body: typedBody,
               userId,
               stripeCustomerId,
               agentId,
@@ -360,13 +361,13 @@ export async function postChatCompletions(params: {
           userId,
           agentId,
           runId: runIdFromBody,
-          model: (body as any)?.model,
+          model: typedBody.model,
           streaming: !!bodyStream,
           hasByokKey: !!openrouterApiKey,
-          messageCount: Array.isArray((body as any)?.messages)
-            ? (body as any).messages.length
+          messageCount: Array.isArray(typedBody.messages)
+            ? typedBody.messages.length
             : 0,
-          messages: (body as any)?.messages,
+          messages: typedBody.messages,
           openrouterStatusCode: openrouterError?.statusCode,
           openrouterStatusText: openrouterError?.statusText,
           openrouterErrorCode: errorDetails?.error?.code,

web/src/llm-api/helpers.ts

@@ -10,6 +10,8 @@ import { PROFIT_MARGIN } from '@codebuff/common/old-constants'
 import type { InsertMessageBigqueryFn } from '@codebuff/common/types/contracts/bigquery'
 import type { Logger } from '@codebuff/common/types/contracts/logger'
 
+import type { ChatCompletionRequestBody } from './types'
+
 export type UsageData = {
   inputTokens: number
   outputTokens: number
@@ -24,21 +26,24 @@ export function extractRequestMetadata(params: {
 }) {
   const { body, logger } = params
 
-  const rawClientId = (body as any)?.codebuff_metadata?.client_id
+  const typedBody = body as ChatCompletionRequestBody | undefined
+  const metadata = typedBody?.codebuff_metadata
+
+  const rawClientId = metadata?.client_id
   const clientId = typeof rawClientId === 'string' ? rawClientId : null
   if (!clientId) {
     logger.warn({ body }, 'Received request without client_id')
   }
 
-  const rawRunId = (body as any)?.codebuff_metadata?.run_id
+  const rawRunId = metadata?.run_id
   const clientRequestId: string | null =
     typeof rawRunId === 'string' ? rawRunId : null
   if (!clientRequestId) {
     logger.warn({ body }, 'Received request without run_id')
   }
 
-  const n = (body as any)?.codebuff_metadata?.n
-  const rawCostMode = (body as any)?.codebuff_metadata?.cost_mode
+  const n = metadata?.n
+  const rawCostMode = metadata?.cost_mode
   const costMode = typeof rawCostMode === 'string' ? rawCostMode : undefined
   return { clientId, clientRequestId, costMode, ...(n && { n }) }
 }

web/src/llm-api/openai.ts

@@ -9,6 +9,7 @@ import {
 import type { UsageData } from './helpers'
 import type { InsertMessageBigqueryFn } from '@codebuff/common/types/contracts/bigquery'
 import type { Logger } from '@codebuff/common/types/contracts/logger'
+import type { ChatCompletionRequestBody } from './types'
 
 export const OPENAI_SUPPORTED_MODELS = ['gpt-5', 'gpt-5.1'] as const
 export type OpenAIModel = (typeof OPENAI_SUPPORTED_MODELS)[number]
@@ -71,7 +72,7 @@ export async function handleOpenAINonStream({
   logger,
   insertMessageBigquery,
 }: {
-  body: any
+  body: ChatCompletionRequestBody
   userId: string
   stripeCustomerId?: string | null
   agentId: string
@@ -108,7 +109,7 @@ export async function handleOpenAINonStream({
   // Transform max_tokens to max_completion_tokens
   openaiBody.max_completion_tokens =
     openaiBody.max_completion_tokens ?? openaiBody.max_tokens
-  delete (openaiBody as any).max_tokens
+  delete openaiBody.max_tokens
 
   // Transform reasoning to reasoning_effort
   if (openaiBody.reasoning && typeof openaiBody.reasoning === 'object') {
@@ -122,14 +123,14 @@ export async function handleOpenAINonStream({
       openaiBody.reasoning_effort = reasoning.effort ?? 'medium'
     }
   }
-  delete (openaiBody as any).reasoning
+  delete openaiBody.reasoning
 
   // Remove fields that OpenAI doesn't support
-  delete (openaiBody as any).stop
-  delete (openaiBody as any).usage
-  delete (openaiBody as any).provider
-  delete (openaiBody as any).transforms
-  delete (openaiBody as any).codebuff_metadata
+  delete openaiBody.stop
+  delete openaiBody.usage
+  delete openaiBody.provider
+  delete openaiBody.transforms
+  delete openaiBody.codebuff_metadata
 
   const response = await fetch('https://api.openai.com/v1/chat/completions', {
     method: 'POST',

web/src/llm-api/openrouter.ts

@@ -16,6 +16,10 @@ import type { UsageData } from './helpers'
 import type { OpenRouterStreamChatCompletionChunk } from './type/openrouter'
 import type { InsertMessageBigqueryFn } from '@codebuff/common/types/contracts/bigquery'
 import type { Logger } from '@codebuff/common/types/contracts/logger'
+import type {
+  ChatCompletionRequestBody,
+  OpenRouterErrorMetadata,
+} from './types'
 
 type StreamState = { responseText: string; reasoningText: string }
 
@@ -26,7 +30,7 @@ type LineResult = {
 }
 
 function createOpenRouterRequest(params: {
-  body: any
+  body: ChatCompletionRequestBody
   openrouterApiKey: string | null
   fetch: typeof globalThis.fetch
 }) {
@@ -61,7 +65,8 @@ function extractRequestMetadataWithN(params: {
 }) {
   const { body, logger } = params
   const { clientId, clientRequestId, costMode } = extractRequestMetadata({ body, logger })
-  const n = (body as any)?.codebuff_metadata?.n
+  const typedBody = body as ChatCompletionRequestBody | undefined
+  const n = typedBody?.codebuff_metadata?.n
   return { clientId, clientRequestId, costMode, ...(n && { n }) }
 }
 
@@ -75,7 +80,7 @@ export async function handleOpenRouterNonStream({
   logger,
   insertMessageBigquery,
 }: {
-  body: any
+  body: ChatCompletionRequestBody
   userId: string
   stripeCustomerId?: string | null
   agentId: string
@@ -98,7 +103,7 @@ export async function handleOpenRouterNonStream({
   const byok = openrouterApiKey !== null
 
   // If n > 1, make n parallel requests
-  if (n > 1) {
+  if (n && n > 1) {
     const requests = Array.from({ length: n }, () =>
       createOpenRouterRequest({ body, openrouterApiKey, fetch }),
     )
@@ -259,7 +264,7 @@ export async function handleOpenRouterStream({
   logger,
   insertMessageBigquery,
 }: {
-  body: any
+  body: ChatCompletionRequestBody
   userId: string
   stripeCustomerId?: string | null
   agentId: string