[codex] Handle invalid cached wrapping keys

[SirAndrosBot]

What changed

• Validate that Windows Hello decrypts the cached wrapping key to exactly 32 bytes before passing it to KeePass AES.
• Add a presentable InvalidProtectedKeyException for malformed cached wrapping-key material.
• Remove only the affected database's cached key when this validation fails.
• Keep the Windows Hello provider and other database caches intact.
• Leave the normal KeePass master-key prompt available on the normal desktop.
• Preserve secure desktop: if quick unlock had redirected the prompt to the main desktop, cancel that temporary prompt and require the user to start unlock again so password entry returns to secure desktop.
• Add the new exception source file to the legacy/PLGX project.

Why

Issue #98 reports a long Windows Hello unlock followed by an abort. The maintainer noted that the screenshot error is thrown when pbKey != 32.

KeePassWinHello generates a 256-bit (32-byte) random wrapping password and protects it with Windows Hello. A valid cached entry created by this plugin must therefore decrypt to exactly 32 bytes. Any other length is corrupt, tampered, or foreign cached material; it must not be padded, truncated, or passed to the AES engine.

Previously the invalid length reached KeePass's AES validation and produced a low-level ArgumentOutOfRangeException for pbKey. The generic cleanup path removed the cache entry, but the user saw a confusing internal error. The new path validates earlier, reports the actual recovery action, and keeps normal authentication available.

Security behavior

• Invalid plaintext is zeroed in the existing finally path.
• Only the affected database cache entry is removed.
• Existing provider-integrity failures still use the broader invalid-provider-key revocation path.
• Windows Hello retry/cancellation behavior is unchanged.
• Secure-desktop users are never instructed to enter the master key into the temporary non-secure prompt.

Refs #98

Validation

• Worker subagent implemented the narrow validation and recovery path.
• First reviewer pass found a secure-desktop downgrade in recovery and requested changes.
• Recovery now tracks secure-desktop redirection and cancels the temporary main-desktop prompt.
• Second reviewer pass found no issues and recommended a draft PR.
• git diff --check passed with only Git LF-to-CRLF working-copy warnings.
• MSBuild.exe src\KeePassWinHello.csproj /t:Rebuild /p:Configuration=Release /p:DefineConstants=MONO /p:FrameworkPathOverride=C:\Windows\Microsoft.NET\Framework\v4.0.30319 /p:ReferencePath=C:\proj\KeePassWinHello\lib passed with 0 warnings and 0 errors.

Manual test required

• Corrupt/malformed cached wrapping key in local storage.
• Corrupt/malformed cached wrapping key in Credential Manager storage.
• Normal desktop recovery leaves the password prompt usable.
• Secure desktop recovery cancels the temporary prompt and returns to secure desktop on retry.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud