Hey @ahmed.onawale, sorry for the slow reply, and thanks for the side-by-side repro.
You’re right: plugin agents don’t currently pick up readonly: true. The plugin loader reads the read-only setting from a different frontmatter key, so your plugin agent fell back to full access. This is an issue we’re tracking, both for honoring readonly: true in plugin agents and for documenting it.
In the meantime, you can ship a read-only plugin agent by replacing readonly: true in the plugin agent’s frontmatter with:
permissionMode: readonly
Then run Developer: Reload Window and repeat your probe. The plugin agent should refuse the Write and the touch, like the project agent does. Let me know if it doesn’t. @sattyamjjain, thanks for the extra context. Until this changes, permissionMode: readonly is the key plugin agents honor.