Improve Windows sandbox helper cancel error

codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs

@@ -59,6 +59,14 @@ const WINDOWS_PLATFORM_DEFAULT_READ_ROOTS: &[&str] = &[
     r"C:\ProgramData",
 ];
 
+fn setup_helper_launch_failure_message(last_error: u32) -> String {
+    if last_error == ERROR_CANCELLED {
+        "Windows canceled the sandbox setup helper launch (error 1223). This usually means the UAC elevation prompt was dismissed or denied before the helper could start.".to_string()
+    } else {
+        format!("ShellExecuteExW failed to launch setup helper: {last_error}")
+    }
+}
+
 pub fn sandbox_dir(codex_home: &Path) -> PathBuf {
     codex_home.join(".sandbox")
 }
@@ -686,7 +694,7 @@ fn run_setup_exe(
         };
         return Err(failure(
             code,
-            format!("ShellExecuteExW failed to launch setup helper: {last_error}"),
+            setup_helper_launch_failure_message(last_error),
         ));
     }
     unsafe {
@@ -963,6 +971,23 @@ mod tests {
         );
     }
 
+    #[test]
+    fn canceled_helper_launch_message_mentions_uac() {
+        let message = super::setup_helper_launch_failure_message(super::ERROR_CANCELLED);
+
+        assert!(message.contains("1223"));
+        assert!(message.contains("UAC"));
+        assert!(message.contains("dismissed or denied"));
+    }
+
+    #[test]
+    fn generic_helper_launch_message_preserves_error_code() {
+        assert_eq!(
+            super::setup_helper_launch_failure_message(5),
+            "ShellExecuteExW failed to launch setup helper: 5"
+        );
+    }
+
     #[test]
     fn profile_read_roots_excludes_configured_top_level_entries() {
         let tmp = TempDir::new().expect("tempdir");