Improve diagnostics for policy-blocked sandbox launches

[Ross Nichols (rossnichols)]

📖 Description

Improve the error reported when Windows blocks a sandboxed process launch with ERROR_ACCESS_DISABLED_BY_POLICY (1260).

The shared launch diagnostic now identifies the failure as an IT-managed policy restriction and directs the user to contact their system administrator. Both the BaseContainer and AppContainer launch paths use this policy-specific diagnostic, which takes priority over executable heuristics and prevents misleading guidance such as adding the root drive to readonlyPaths.

🔗 References

No linked issue.

🔍 Validation

cargo fmt --all -- --check

cargo test -p appcontainer_common --lib

cargo clippy -p appcontainer_common --lib -- -D warnings

237 tests passed, including regression coverage for the policy-specific AppContainer path and preservation of unrelated CreateProcessW errors.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (not applicable)
• Updated Copilot instructions (not applicable)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (not applicable; Cargo.lock is unchanged)

📋 Issue Type

• Bug fix
• Feature
• Task

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds a policy-specific diagnostic for Windows launch error 1260.

Changes:

• Prioritizes policy-block detection over executable heuristics.
• Adds regression coverage for the diagnostic.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Ross Nichols (rossnichols)]

Fixed in 6d70474. AppContainer CreateProcessW failures now decode HRESULT_FROM_WIN32 values and route them through the shared launch diagnostic while preserving working-directory context. Added caller-level regression coverage; cargo fmt, all 236 appcontainer_common lib tests, and targeted clippy pass.

[Ross Nichols (rossnichols)]

Refined in 12e1c07: AppContainer delegates to the shared diagnostic only for ERROR_ACCESS_DISABLED_BY_POLICY (1260). All other CreateProcessW failures retain the existing AppContainer error text. Added a regression test using ERROR_CALL_NOT_IMPLEMENTED to ensure BaseContainer-specific guidance is not emitted. Formatting, all 237 appcontainer_common lib tests, and targeted clippy pass.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/backends/appcontainer/common/src/appcontainer_runner.rs:82

• Routing every FACILITY_WIN32 error through this helper changes unrelated AppContainer failures to inaccurate BaseContainer diagnostics. For example, an ordinary CreateProcessW ERROR_FILE_NOT_FOUND now reports CreateProcessInSandbox failed, and ERROR_CALL_NOT_IMPLEMENTED claims that Experimental_CreateProcessInSandbox/BaseContainer is disabled even though neither API was used. Restrict this delegation to ERROR_ACCESS_DISABLED_BY_POLICY so the new policy guidance is shared without regressing all other AppContainer error messages.

    let message = if (hresult >> 16) & 0x1FFF == 7 {
        diagnose_create_process_failure(hresult & 0xFFFF, command_line, readonly_paths).message

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Jeff Whiteside (jsidewhite)]