Sandbox seems to disable write even to ~/Downloads & ~/tmp

I'm trying to avoid Full Disk Access but sandbox seems to not allow file writes even to Downloads or /tmp despite what the readme says:

[2:39:02 PM] [18:39:02] poke-gate starting...
[2:39:02 PM] [18:39:02] Access mode: sandbox
[2:39:02 PM] [18:39:02] MCP server on port 62175
[2:39:02 PM] [18:39:02] Connecting tunnel to Poke...
[2:39:02 PM] [18:39:02] Cleaning up 1 old connection(s)…
[2:39:03 PM] [18:39:03] Tunnel connected (81a3d46f-c7a5-4c66-96a1-502413f68cd5)
[2:39:03 PM] [18:39:03] Ready — your Poke agent can now access this machine.
[2:39:03 PM] [18:39:03] [agents] No agents found. Add scripts to ~/.config/poke-gate/agents/
[2:39:03 PM] [18:39:03] Notified Poke agent about connection.
[2:44:03 PM] [18:44:03] Tools synced: 0
[2:48:37 PM] [18:48:37] tool: system_info
[2:48:42 PM] [18:48:42] tool: write_file
[2:48:42 PM] [18:48:42] write: /Users/jsoffer/Downloads/sandbox_test.txt
[2:48:42 PM] [18:48:42] error
[2:48:44 PM] [18:48:44] tool: list_directory
[2:48:44 PM] [18:48:44] ls: /Users/jsoffer/Documents/Scripts/poke
[2:48:44 PM] [18:48:44] tool: write_file
[2:48:44 PM] [18:48:44] write: /tmp/sandbox_test.txt
[2:48:44 PM] [18:48:44] error
[2:48:45 PM] [18:48:45] tool: read_file
[2:48:45 PM] [18:48:45] read: /Users/jsoffer/Downloads/sandbox_test.txt
[2:48:45 PM] [18:48:45] error
[2:48:57 PM] [18:48:57] tool: run_command
[2:48:57 PM] [18:48:57] $ printf "sandbox test file
[2:48:57 PM] " > /Users/jsoffer/Downloads/sandbox_test.txt
[2:48:57 PM] [18:48:57] error
[2:48:58 PM] [18:48:58] tool: run_command
[2:48:58 PM] [18:48:58] $ printf "sandbox test file
[2:48:58 PM] " > /tmp/sandbox_test.txt
[2:48:58 PM] [18:48:58] error
[2:49:03 PM] [18:49:03] Tools synced: 0
[2:50:13 PM] [18:50:13] tool: write_file
[2:50:13 PM] [18:50:13] write: /Users/jsoffer/Downloads/sandbox_retry.txt
[2:50:13 PM] [18:50:13] error
[2:50:15 PM] [18:50:15] tool: write_file
[2:50:15 PM] [18:50:15] write: /tmp/sandbox_retry.txt
[2:50:15 PM] [18:50:15] error
[2:50:16 PM] [18:50:16] tool: list_directory
[2:50:16 PM] [18:50:16] ls: /Users/jsoffer/Documents/Scripts/poke
[2:50:17 PM] [18:50:17] tool: list_directory
[2:50:17 PM] [18:50:17] ls: /Users/jsoffer/Downloads
[2:50:18 PM] [18:50:18] tool: read_file
[2:50:18 PM] [18:50:18] read: /Users/jsoffer/Downloads/.DS_Store
[2:52:21 PM] [18:52:21] tool: read_file
[2:52:21 PM] [18:52:21] read: /Users/jsoffer/Downloads/transcript.txt
[2:54:03 PM] [18:54:03] Tools synced: 0
[2:59:03 PM] [18:59:03] Tools synced: 0
[3:04:03 PM] [19:04:03] Tools synced: 0