[devin-ai-integration]

Summary

Faster sign-in for returning users. The sign-in page now has "Continue with Google" and "Sign in with a passkey" in addition to the email code. Both are login only: initOAuth({ provider: "google", disableSignup: true }), and passkey sign-up stays off in the Privy dashboard.

Why login only: in Privy, a Google login with an email that already has an email-code account creates a separate user, with a different embedded wallet and so a different payout account. That would split the account. Instead, a signed-in user turns these on from the bookings page (QuickSignIn card: useLinkWithOAuth / useLinkWithPasskey), so they always attach to the same Privy user, bookings and payout account. If someone tries Google or a passkey before linking it, they see an error explaining that they need to sign in with an email code first and turn it on.

loginMethods: ["email", "google", "passkey"].

Duplicate embedded wallets. A brand-new email account got 4 Privy embedded wallets on its first sign-in. The likely cause is RequireSession's fallback createWallet() racing Privy's createOnLogin and re-firing on every render. The fallback now:

• waits 3 s,
• runs once at a time, and "Try again" retries it after a failure,
• never creates a wallet when user.linkedAccounts already lists a Privy wallet. If that wallet has no address after 15 s, the user sees an error with "Try again".

Stable payout account. requireUser now keeps the wallet already stored in profiles if the user still has it, instead of always taking the first Privy wallet in the list. If the profile read fails, the request returns a 503 instead of picking a wallet:

wallet = embedded.find(w => w == profiles[privy_id].wallet) ?? embedded[0] ?? null

Testing (local dev server against the real Privy app and Supabase, Playwright over CDP with a virtual WebAuthn authenticator)

Passed twice in a row, each time with a fresh email:

1. Before linking, the passkey button shows the "sign in with an email code first" error.
2. Email-code sign-up lands on /app/new. The Privy API shows 1 embedded wallet (the earlier bug produced 4).
3. "Add a passkey" on /app links it (Privy linked accounts: email, wallet, passkey).
4. Sign out, then "Sign in with a passkey" lands on /app/new with no code and the same single wallet, and the bookings page shows "Passkey sign-in is on".
5. "Continue with Google" redirects to accounts.google.com.

One earlier run timed out on step 4: the page stayed on sign-in after the passkey prompt. That run was before the review-fix commit, and the cause is unknown.

Not tested: completing Google sign-in or linking (needs a real Google account), and real device passkeys (only the virtual authenticator).

Link to Devin session: https://app.devin.ai/sessions/dc532fa9edf5401189dae9b7e6c5259c
Open in Devin Desktop: https://app.devin.ai/desktop/session/dc532fa9edf5401189dae9b7e6c5259c?variant=devin
Requested by: @CryptoZephyr

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
setlo	Ready	Preview	Oct 3, 2026 3:09pm UTC

[devin-ai-integration]

Devin Review found 3 potential issues.