fix(OPENFRAM-002-15): Hardcoded placeholder secret substituted for ${client.openframeSecret} instead of resolving real credential

[flamingo]

Closes findings from rule OPENFRAM-002-15 — Hardcoded placeholder secret substituted for ${client.openframeSecret} instead of resolving real credential.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🔴 55 low — review closely	Hardcoded placeholder secret substituted for ${client.openframeSecret} instead of resolving real credential	clients/openframe-client/src/services/tool_command_params_resolver.rs:47

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 59051284-b3d6-4391-892c-38c8737386e1

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft. (Inline placement was rejected by GitHub for this PR.)

🔴 1. Hardcoded placeholder secret substituted for ${client.openframeSecret} instead of resolving real credential — clients/openframe-client/src/services/tool_command_params_resolver.rs:47
In process, replaced the hardcoded literal "12345678901234567890123456789012" with a call to self.initial_configuration_service.get_openframe_secret()?, storing the result in a new openframe_secret local variable used in the .replace(...) chain. This assumes InitialConfigurationService exposes a get_openframe_secret() -> Result<String> method analogous to get_server_url(); since that method's existence/signature could not be verified in this file, the reviewer must confirm it exists on InitialConfigurationService (or add it) — if the method name/signature differs, this will fail to compile, and a complete fix would require locating/adding that accessor in the service module.

🤖 Prompt for AI agents

In clients/openframe-client/src/services/tool_command_params_resolver.rs around line 47, review and complete this code-review fix: Hardcoded placeholder secret substituted for ${client.openframeSecret} instead of resolving real credential.
What the draft fix changed: In `process`, replaced the hardcoded literal `"12345678901234567890123456789012"` with a call to `self.initial_configuration_service.get_openframe_secret()?`, storing the result in a new `openframe_secret` local variable used in the `.replace(...)` chain. This assumes `InitialConfigurationService` exposes a `get_openframe_secret() -> Result<String>` method analogous to `get_server_url()`; since that method's existence/signature could not be verified in this file, the reviewer must confirm it exists on `InitialConfigurationService` (or add it) — if the method name/signature differs, this will fail to compile, and a complete fix would require locating/adding that accessor in the service module.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer