fix(OPENFRAM-007-2): CU-86akhf8u5 2 review findings in layout.tsx

[flamingo]

Closes 2 review findings in src/app/layout.tsx.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🔴 40 low — review closely	Direct process.env.NEXT_PUBLIC_APP_URL reads bypass the runtimeEnv abstraction	src/app/layout.tsx:29
2	🔴 40 low — review closely	Direct process.env.NEXT_PUBLIC_APP_URL read in openGraph.url bypasses runtimeEnv	src/app/layout.tsx:44

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: c69bf2d8-6eaa-4e2d-815b-af08b880c8df

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akhf8u5 OpenFrame OSS frontend review findings sweep (12 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

2 finding(s) fixed in this draft — 2 explained inline on the diff; 2 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🟠 Direct process.env.NEXT_PUBLIC_APP_URL reads bypass the runtimeEnv abstraction

Replaced new URL(process.env.NEXT_PUBLIC_APP_URL || 'https://openframe.ai') in metadata.metadataBase with new URL(runtimeEnv.appUrl()) in src/app/layout.tsx. This assumes runtimeEnv.appUrl() exists (or will be added) on the runtimeEnv object exported from src/lib/runtime-config.ts and returns a string with the same fallback ('https://openframe.ai') baked in; since I cannot see/edit that file in this task, this accessor must be added there for the build to compile — without it this is a broken import member, not a working fix.

🤖 Prompt for AI agents

In src/app/layout.tsx around line 29, review and complete this code-review fix: Direct process.env.NEXT_PUBLIC_APP_URL reads bypass the runtimeEnv abstraction.
What the draft fix changed: Replaced `new URL(process.env.NEXT_PUBLIC_APP_URL || 'https://openframe.ai')` in `metadata.metadataBase` with `new URL(runtimeEnv.appUrl())` in src/app/layout.tsx. This assumes `runtimeEnv.appUrl()` exists (or will be added) on the `runtimeEnv` object exported from src/lib/runtime-config.ts and returns a string with the same fallback ('https://openframe.ai') baked in; since I cannot see/edit that file in this task, this accessor must be added there for the build to compile — without it this is a broken import member, not a working fix.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 40 low — review closely — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 Direct process.env.NEXT_PUBLIC_APP_URL read in openGraph.url bypasses runtimeEnv

Replaced process.env.NEXT_PUBLIC_APP_URL || 'https://openframe.ai' in metadata.openGraph.url with runtimeEnv.appUrl() in src/app/layout.tsx, same mechanism and same caveat as finding 1: it depends on runtimeEnv.appUrl() being implemented in src/lib/runtime-config.ts with equivalent fallback semantics, which is outside this file and not verified here.

🤖 Prompt for AI agents

In src/app/layout.tsx around line 44, review and complete this code-review fix: Direct process.env.NEXT_PUBLIC_APP_URL read in openGraph.url bypasses runtimeEnv.
What the draft fix changed: Replaced `process.env.NEXT_PUBLIC_APP_URL || 'https://openframe.ai'` in `metadata.openGraph.url` with `runtimeEnv.appUrl()` in src/app/layout.tsx, same mechanism and same caveat as finding 1: it depends on `runtimeEnv.appUrl()` being implemented in src/lib/runtime-config.ts with equivalent fallback semantics, which is outside this file and not verified here.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 40 low — review closely — react 👍/👎 to teach the reviewer

[michaelassraf]

Task linked: CU-86akhf8u5 OpenFrame OSS frontend review findings sweep (12 PRs)