fix(connections): preserve reconnect approval gates

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/tool-access-service.test.ts

@@ -6103,7 +6103,12 @@ describeEmbeddedPostgres("tool access service", () => {
     await expect(db.select().from(toolPolicies).where(and(
       eq(toolPolicies.companyId, company.id),
       eq(toolPolicies.enabled, true),
-    ))).resolves.toHaveLength(0);
+    ))).resolves.toEqual([
+      expect.objectContaining({
+        policyType: "require_approval",
+        selectors: { catalogEntryId: updateEntry.id },
+      }),
+    ]);
   });
 
   it("stops and restarts local stdio runtime slots through the board service", async () => {

server/src/services/tool-access.ts

@@ -4266,15 +4266,6 @@ export function toolAccessService(db: Db, options: ToolAccessServiceOptions = {}
       activeCatalogEntryIds: activeEntries.map((entry) => entry.id),
       actor,
     });
-    if (refreshOptions.enableAllByDefault) {
-      await upsertAskFirstPolicies({
-        companyId: updatedConnection.companyId,
-        connection: updatedConnection,
-        askFirstEntries: [],
-        actor,
-      });
-    }
-
     await audit({
       companyId: connection.companyId,
       connectionId: connection.id,