fix(mcp): audit record keeps legacy name/index alias targets

A caller using the #38 aliases (name for repo, index for number) left no
target in the tools/call audit record.

Refs #64

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/mcp/audit.go

@@ -16,7 +16,7 @@ import (
 // they identify what a call acted on without copying what it wrote. Every
 // other argument (file content, issue bodies) is reduced to args_bytes so the
 // audit trail never becomes a second copy of repo content (gitea-mcp#64).
-var auditTargetKeys = []string{"owner", "repo", "number", "branch", "path", "tag"}
+var auditTargetKeys = []string{"owner", "repo", "name", "number", "index", "branch", "path", "tag"}
 
 // logToolCall emits one structured record per tools/call (OWASP MCP08).
 func logToolCall(ctx context.Context, name string, args json.RawMessage, start time.Time, err error) {

internal/mcp/audit_test.go

@@ -121,3 +121,15 @@ func TestToolsCallAuditOmitsArgumentValuesOtherThanTarget(t *testing.T) {
 	assert.NotContains(t, string(raw), sentinel)
 	assert.Contains(t, recs[0], "args_bytes")
 }
+
+// #38 keeps `name` (for repo) and `index` (for number) as legacy aliases; a
+// caller using them must still leave a target in the audit record.
+func TestToolsCallAuditRecordsLegacyAliasTargets(t *testing.T) {
+	recs := captureAudit(t, func() {
+		callTool(t, auditServer(auditStubTool{name: "issue_close"}), "issue_close",
+			map[string]any{"owner": "mathias", "name": "infra", "index": 7})
+	})
+	require.Len(t, recs, 1)
+	assert.Equal(t, "infra", recs[0]["name"])
+	assert.EqualValues(t, 7, recs[0]["index"])
+}