@@ -28,6 +28,7 @@ import * as GitLabCli from "../src/sourceControl/GitLabCli.ts";
 import * as ForgejoCli from "../src/sourceControl/ForgejoCli.ts";
 import * as AzureDevOpsCli from "../src/sourceControl/AzureDevOpsCli.ts";
 import * as BitbucketApi from "../src/sourceControl/BitbucketApi.ts";
+import * as ServerSettings from "../src/serverSettings.ts";
 import * as VcsProcess from "../src/vcs/VcsProcess.ts";
 import * as VcsDriverRegistry from "../src/vcs/VcsDriverRegistry.ts";
 import * as VcsProjectConfig from "../src/vcs/VcsProjectConfig.ts";
@@ -155,7 +156,8 @@ await Effect.runPromise(
               GitLabCli.layer,
               ForgejoCli.layer,
               AzureDevOpsCli.layer,
-              BitbucketApi.layer,
+              // No saved credentials here; Bitbucket falls back to T3CODE_BITBUCKET_* variables.
+              BitbucketApi.layer.pipe(Layer.provide(ServerSettings.layerTest())),
             ),
           ),
           Layer.provide(VcsDriverRegistry.layer.pipe(Layer.provide(VcsProjectConfig.layer))),
 
@@ -47,8 +47,8 @@ function savedMethod(saved: BitbucketSettings): CredentialMethod | null {
 }
 
 /**
- * A write-only token field. A saved token shows as a filled password field; typing replaces
- * it, and leaving the field empty restores the saved one. `draft` is null until edited.
+ * A write-only token field. A saved token shows as a filled password field; focusing it starts
+ * a fresh token, and leaving that empty restores the saved one. `draft` is null until edited.
  */
 function TokenInput({
   id,
@@ -70,17 +70,10 @@ function TokenInput({
       size="sm"
       placeholder={isSaved ? undefined : "Not set"}
       value={masked ? SAVED_TOKEN_MASK : (draft ?? "")}
-      onFocus={(event) => {
-        if (masked) event.target.select();
-      }}
-      onChange={(event) => {
-        const value = event.target.value;
-        if (!masked) return onDraftChange(value);
-        // Typing at the end of the mask, or deleting into it, starts a fresh token.
-        if (value.startsWith(SAVED_TOKEN_MASK))
-          return onDraftChange(value.slice(SAVED_TOKEN_MASK.length));
-        onDraftChange(SAVED_TOKEN_MASK.startsWith(value) ? "" : value);
+      onFocus={() => {
+        if (masked) onDraftChange("");
       }}
+      onChange={(event) => onDraftChange(event.target.value)}
       onBlur={() => {
         if (isSaved && draft === "") onDraftChange(null);
       }}
 
@@ -597,6 +597,8 @@ export function SourceControlSettingsPanel() {
                   {item.kind === "bitbucket" ? (
                     <SettingsSearchTarget id={searchableSetting("bitbucket-credentials").id}>
                       <BitbucketCredentialsSettings
+                        // Drafts belong to one environment; switching must not carry them over.
+                        key={environmentId}
                         environmentId={environmentId}
                         onSaved={handleScan}
                       />