From f0ad65609906f8e89406f407b5ab6b55ca763c18 Mon Sep 17 00:00:00 2001
From: harsh mahajan <harshmahajan2345@gmail.com>
Date: Fri, 7 Aug 2026 17:25:05 +0530
Subject: [PATCH 1/2] feat: report whether an archive url carries its own
 credential

A caller that can only fetch a url reaches a private repository through the
credential the url carries. Bitbucket's archive host takes none from the
url -- a token offered as basic userinfo is answered with a redirect to a
login page, so what comes back is a login rather than an archive, and the
fetch lands empty with nothing to say why.

Adapters report whether their archive url stands on its own, so a caller can
clone what it cannot download. Bitbucket's git endpoint accepts the token the
archive host refuses.
---
 src/VCS/Adapter/Git.php           | 10 ++++++++++
 src/VCS/Adapter/Git/Bitbucket.php | 11 +++++++++++
 2 files changed, 21 insertions(+)

diff --git a/src/VCS/Adapter/Git.php b/src/VCS/Adapter/Git.php
index ada9c982..e869e122 100644
--- a/src/VCS/Adapter/Git.php
+++ b/src/VCS/Adapter/Git.php
@@ -99,6 +99,16 @@ abstract public function createWebhook(string $owner, string $repositoryName, st
      */
     abstract public function createTag(string $owner, string $repositoryName, string $tagName, string $target, string $message = ''): array;
 
+    /**
+     * Whether the archive url this adapter hands out carries its own
+     * credential, so a caller that can only fetch a url still reaches a
+     * private repository through it.
+     */
+    public function supportsAuthenticatedArchiveUrl(): bool
+    {
+        return true;
+    }
+
     /**
      * Get a short-lived URL to download the repository archive.
      *
diff --git a/src/VCS/Adapter/Git/Bitbucket.php b/src/VCS/Adapter/Git/Bitbucket.php
index e380f579..1d94674c 100644
--- a/src/VCS/Adapter/Git/Bitbucket.php
+++ b/src/VCS/Adapter/Git/Bitbucket.php
@@ -1413,6 +1413,17 @@ private function authenticatedBitbucketUrl(): string
         return str_replace('://', '://' . $userinfo . '@', $this->bitbucketUrl);
     }
 
+    /**
+     * Bitbucket's archive host takes no credential from the url: a token
+     * offered as basic userinfo is answered with a redirect to a login page,
+     * so what comes back is a login rather than an archive. Its git endpoint
+     * accepts the same token, which is what a caller falls back to.
+     */
+    public function supportsAuthenticatedArchiveUrl(): bool
+    {
+        return false;
+    }
+
     /**
      * @link https://support.atlassian.com/bitbucket-cloud/kb/how-to-download-repositories-using-the-api/
      *

From d173c0191994bc85233e5fab6445be2100ae3116 Mon Sep 17 00:00:00 2001
From: harsh mahajan <harshmahajan2345@gmail.com>
Date: Fri, 7 Aug 2026 17:27:38 +0530
Subject: [PATCH 2/2] style(vcs): keep the archive note to the fact that
 matters

---
 src/VCS/Adapter/Git.php           | 6 +-----
 src/VCS/Adapter/Git/Bitbucket.php | 6 ++----
 2 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/src/VCS/Adapter/Git.php b/src/VCS/Adapter/Git.php
index e869e122..b14a1bec 100644
--- a/src/VCS/Adapter/Git.php
+++ b/src/VCS/Adapter/Git.php
@@ -99,11 +99,7 @@ abstract public function createWebhook(string $owner, string $repositoryName, st
      */
     abstract public function createTag(string $owner, string $repositoryName, string $tagName, string $target, string $message = ''): array;
 
-    /**
-     * Whether the archive url this adapter hands out carries its own
-     * credential, so a caller that can only fetch a url still reaches a
-     * private repository through it.
-     */
+    /** Whether the archive url reaches a private repository on its own. */
     public function supportsAuthenticatedArchiveUrl(): bool
     {
         return true;
diff --git a/src/VCS/Adapter/Git/Bitbucket.php b/src/VCS/Adapter/Git/Bitbucket.php
index 1d94674c..9c3e90b8 100644
--- a/src/VCS/Adapter/Git/Bitbucket.php
+++ b/src/VCS/Adapter/Git/Bitbucket.php
@@ -1414,10 +1414,8 @@ private function authenticatedBitbucketUrl(): string
     }
 
     /**
-     * Bitbucket's archive host takes no credential from the url: a token
-     * offered as basic userinfo is answered with a redirect to a login page,
-     * so what comes back is a login rather than an archive. Its git endpoint
-     * accepts the same token, which is what a caller falls back to.
+     * The archive host answers a token in the url with a redirect to a login
+     * page. The git endpoint accepts the same token.
      */
     public function supportsAuthenticatedArchiveUrl(): bool
     {