Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request improves the security of FIDO2 PIN handling by introducing a feature that masks the PIN input after it has been submitted. This change is facilitated by an upgrade of the demand crate to its version 2, which provides the necessary functionality to obscure sensitive input post-entry.

Highlights

• Dependency Update: The demand dependency has been updated from version 1.x to 2.0.0, enabling new input masking capabilities.
• FIDO2 PIN Masking: FIDO2 PIN input prompts, both for runtime authentication and setup, now mask the entered PIN with asterisks immediately after submission for enhanced security.

Greptile Summary

This PR bumps the demand dependency from v1 to v2.0.0 and adds .password(true) to the two interactive FIDO2 PIN prompts in src/providers/fido2.rs, bringing them in line with how every other secret-input prompt in the codebase already works (e.g. set.rs line 87). The net effect is that the FIDO2 PIN is now hidden as the user types, rather than echoed in plaintext.

Key observations:

• The functional change is a clear security improvement and is consistent with the existing demand usage patterns elsewhere in the project.
• The PR title ("mask PIN on submit") and description ("Add mask_on_submit(true)... PIN is replaced with asterisks after the user submits") do not match the actual implementation — .password(true) hides input during typing, while mask_on_submit(true) would show it while typing and replace it only after submission. The test plan also describes mask_on_submit semantics. The description/test plan should be corrected, or the implementation should be updated to use mask_on_submit(true) if that was the intended UX.
• The demand v1→v2 major-version bump appears safe for this codebase: all other call sites (demand::Input, demand::Confirm, demand::Select) use API that exists in both versions, and the 107-test suite passes.

Confidence Score: 4/5

• Safe to merge — the change is a security improvement with no cryptographic or storage impact, but the PR description and test plan describe a different behaviour than what was actually implemented.
• The code change itself is small, correct, and consistent with existing patterns in the codebase. The only issue is a discrepancy between the PR description/test plan (which claim mask_on_submit / show-then-mask-after-submit semantics) and the actual implementation (.password(true) / hide-during-typing). This is documentation/intent ambiguity rather than a functional defect, and the implemented behaviour is arguably more secure, so confidence is high but not perfect.
• No files require special attention; the discrepancy between the described and actual PIN-masking behaviour in src/providers/fido2.rs should be clarified.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant U as User
    participant P as fido2.rs (PIN prompt)
    participant D as demand::Input (.password(true))
    participant F as FIDO2 Device

    U->>P: Invokes FIDO2 operation
    P->>D: Input::new("FIDO2 PIN…").password(true).run()
    Note over D: Characters hidden during typing (no echo)
    U->>D: Types PIN
    D-->>P: Returns PIN string (or empty)
    alt PIN entered
        P->>F: pass PIN to ctap_hid_fido2
    else Empty input
        P->>F: no PIN
    end
    F-->>P: hmac-secret
    P-->>U: Secret used for encrypt/decrypt

_{Last reviewed commit: a28dba9}