Test buffer file capture permissions

Author: bnomei

README.md

@@ -247,6 +247,8 @@ Known groups:
 | `@kill` | `kill-session`, `kill-window`, `kill-pane`, `detach-client` |
 | `@socket` | `socket-for-path` |
 
+Buffer file operations (`save-buffer` and `load-buffer`) are intentionally part of the existing capture permission surface: `[security].allow_capture = false` denies them alongside `capture-pane` and buffer inspection tools. Use `[security.tools]` for finer-grained filtering (for example, deny `save-buffer`, `load-buffer`, or `@buffer-write`) when capture should remain available but filesystem-backed buffer import/export should not. No separate `allow_buffer_read` or `allow_buffer_write` configuration exists.
+
 ## Tools
 
 ### Core Utilities
@@ -294,12 +296,12 @@ Known groups:
 ### Buffer Management
 - **list-buffers** - List tmux paste buffers
 - **show-buffer** - Show buffer contents (supports offset/max bytes; defaults to 64KB)
-- **save-buffer** - Save buffer contents to a file
+- **save-buffer** - Save buffer contents to a file (writes to the server filesystem; governed by `allow_capture` and `[security.tools]`)
 - **delete-buffer** - Delete a buffer
 
 ### Additional Buffer Tools
 - **set-buffer** - Create or replace a buffer with UTF-8 content
-- **load-buffer** - Load buffer contents from a file
+- **load-buffer** - Load buffer contents from a file (reads from the server filesystem; governed by `allow_capture` and `[security.tools]`)
 - **append-buffer** - Append UTF-8 content to an existing buffer
 - **rename-buffer** - Emulate rename by copying then deleting
 - **search-buffer** - Structured search over one or more buffers (literal/regex + metadata)

src/server.rs

@@ -3457,6 +3457,61 @@ mod tests {
         assert_eq!(first_text(&result), "stub-buffer");
     }
 
+    #[tokio::test]
+    async fn buffer_file_operations_allowed_by_capture_policy() {
+        let _stub = TmuxStub::new();
+        let server = server_with_policy("[security]\nallow_capture = true\n");
+
+        let result = server
+            .load_buffer(Parameters(LoadBufferInput {
+                name: "buffer0".into(),
+                path: "tests/fixtures/old-man-and-the-sea.txt".into(),
+                socket: None,
+            }))
+            .await
+            .expect("load buffer");
+        assert_eq!(result.is_error, Some(false));
+        assert!(first_text(&result).contains("loaded"));
+
+        let result = server
+            .save_buffer(Parameters(SaveBufferInput {
+                name: "buffer0".into(),
+                path: "/tmp/buffer.txt".into(),
+                socket: None,
+            }))
+            .await
+            .expect("save buffer");
+        assert_eq!(result.is_error, Some(false));
+        assert!(first_text(&result).contains("saved"));
+    }
+
+    #[tokio::test]
+    async fn buffer_file_operations_denied_by_capture_policy() {
+        let server = server_with_policy("[security]\nallow_capture = false\n");
+
+        let result = server
+            .load_buffer(Parameters(LoadBufferInput {
+                name: "buffer0".into(),
+                path: "tests/fixtures/old-man-and-the-sea.txt".into(),
+                socket: None,
+            }))
+            .await
+            .expect("load buffer");
+        assert_eq!(result.is_error, Some(true));
+        assert!(first_text(&result).contains("not allowed by security policy"));
+
+        let result = server
+            .save_buffer(Parameters(SaveBufferInput {
+                name: "buffer0".into(),
+                path: "/tmp/buffer.txt".into(),
+                socket: None,
+            }))
+            .await
+            .expect("save buffer");
+        assert_eq!(result.is_error, Some(true));
+        assert!(first_text(&result).contains("not allowed by security policy"));
+    }
+
     #[tokio::test]
     async fn save_delete_and_detach_happy_path() {
         let _stub = TmuxStub::new();