[stanislavlysenko0912]

Summary

On a toolkit page, a policy set from a tool or folder row in the tree saved a pattern with the owner and connection twice, for example google_gmail.user.me.user.me.gmail.users.labels.*. The pattern never matched, so the rule silently did nothing and write tools still asked for approval.

The toolkit page passed the full tool id (integration.owner.connection.tool) as the tree row name. Since #2062, rows inside an account section add owner.connection to that name. The toolkit page now passes integration.tool for non-static tools, as the integration Tools tab already does. This also drops the redundant user → <connection> levels from the tree.

Verification

• Self-hosted 1.6.11 with this change applied: a folder rule and a tool rule set from the tree saved google_gmail.user.<conn>.gmail.users.drafts.* and ...drafts.delete. A drafts.create + drafts.delete call over the toolkit MCP ran without an approval prompt.
• bun run format:check
• bun run lint
• bun run typecheck (@executor-js/plugin-toolkits and its dependents)
• bun run test (@executor-js/plugin-toolkits and its dependents)

Checklist

• Added a changeset (bun run changeset)
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.