The current sandbox extension instructions state the glob configuration file must exist at `~/.pi/agent/sandbox.json` whereas it actually must exist at `~/.pi/agent/extensions/sandbox.json` to be picked up.
Returning { isError: true } from a tool's execute function was silently
ignored - the agent loop only sets isError via the catch block. Fix the
with-deps example to throw instead, add a clear note in the Tool Definition
docs section, and update the Error Handling summary.
closes#1881