refactor(mcp): use shared appswire toolInvocation meta helper

[pcfreak30]

Switches the CLI-local app-helper _meta to the shared appswire.ToolInvocationMeta helper, replacing manual nested openai/toolInvocation objects with the contract's flat slash-delimited keys.

Adds ResourceURI and Visibility to the handoff ResumeToolSpec so the *_status and *_resume tools register their view attachment through the shared helper. Bumps go.lumeweb.com/pinner to the merge commit exposing meta.go.

---

Summary

This refactor centralizes the generation of OpenAI tool-invocation metadata (openai/toolInvocation) behind a single shared helper, appswire.ToolInvocationMeta, and updates every tool that previously hand-wrote this metadata to use it.

What changed

Shared meta helper adoption

• internal/mcp/apps/apps.go (pin_status helper) and internal/mcp/upload/upload_vault_app.go (vault_upload_submit helper) now call appswire.ToolInvocationMeta(...) instead of constructing the nested meta map inline.
• internal/mcp/core/handoff/handoff_registry.go (resume tool template) now uses the same shared helper and wires the tool's ResourceURI and Visibility into the generated metadata.

Resume tool API change

• handoff.NewResumeTool now returns (model.ToolDescriptor, error) instead of just a descriptor. The only error path is an empty ResourceURI in the spec — a wiring bug.
• Added handoff.MustResumeTool, a convenience wrapper that panics on that error, to preserve the single-value ergonomics for callers with constant, valid specs. All existing callers (auth_sso, oob/vault_handoff, vault/vault_create_app, vault/vault_restore_app) were updated to supply ResourceURI and Visibility and to use the wrapper.

Metadata format change

• The tool-invocation info is now emitted at flat slash-delimited keys (openai/toolInvocation/invoking and /invoked) instead of a nested openai/toolInvocation object. This matches the contract produced by the shared appswire.ToolInvocationMeta helper across all tools.

Tests

• Added tests asserting the flat metadata format for pin_status, vault_upload_submit, and the resume template.
• Added a test verifying that a resume spec missing ResourceURI fails via error return (and therefore would panic through MustResumeTool).
• Updated existing tests to pass the newly required ResourceURI/Visibility fields.

Impact

• Removes duplicated, error-prone inline meta construction across four tools.
• Aligns all tools on a single, consistent metadata shape.
• Makes missing tool-wiring configuration (empty resource URI) fail fast instead of silently producing invalid metadata.

[kody-ai]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[github-actions]

Code Coverage Report

Total Coverage: 55.3%

Generated from commit: bb1bd97
Repository: LumeWeb/pinner-cli