[fix]. Harden fork PR fetch + config marker

tests/test_container_runner.py

@@ -36,6 +36,22 @@ def _sample_pr() -> PullRequestContext:
     )
 
 
+def _sample_fork_pr() -> PullRequestContext:
+    return PullRequestContext(
+        repo="acme/repo",
+        pr_number=2,
+        base_ref="main",
+        base_sha="c" * 40,
+        head_ref="feature",
+        head_sha="d" * 40,
+        clone_url="https://gitea.test/fork/repo.git",
+        base_clone_url="https://gitea.test/acme/repo.git",
+        head_clone_url="https://gitea.test/fork/repo.git",
+        html_url="https://gitea.test/acme/repo/pulls/2",
+        is_fork=True,
+    )
+
+
 def test_build_docker_command_api_key_mode_uses_openai_env() -> None:
     settings = get_settings()
 
@@ -84,7 +100,10 @@ def test_build_install_command_chatgpt_mode_sets_git_checkout_and_review(monkeyp
     assert 'printf "%s" "$CODEX_AUTH_JSON_B64" | base64 -d > /root/.codex/auth.json' in command
     assert "git -c http.extraHeader=" in command
     assert f"clone --no-tags --depth 80 {pr.clone_url} /work/repo" in command
-    assert f"fetch --no-tags origin {pr.base_ref} {pr.head_ref}" in command
+    assert "fetch_required() {" in command
+    assert f"fetch_required origin {pr.head_ref} {pr.head_sha} head" in command
+    assert f"fetch_required \"$base_remote\" {pr.base_ref} {pr.base_sha} base" in command
+    assert "base_remote=origin" in command
     assert f"git checkout --detach {pr.head_sha}" in command
     assert "resolved_head=\"$(git rev-parse HEAD)\"" in command
     assert "unset GITEA_TOKEN auth_b64" in command
@@ -107,6 +126,18 @@ def test_build_install_command_does_not_include_reasoning_effort_flag() -> None:
     assert "--reasoning-effort" not in command
 
 
+def test_build_install_command_uses_upstream_remote_for_fork_pr_base_fetch() -> None:
+    settings = get_settings()
+    pr = _sample_fork_pr()
+
+    command = _build_install_and_run_command(settings, pr=pr)
+
+    assert "base_remote=upstream" in command
+    assert f"git remote add upstream {pr.base_clone_url}" in command
+    assert f"fetch_required origin {pr.head_ref} {pr.head_sha} head" in command
+    assert f"fetch_required \"$base_remote\" {pr.base_ref} {pr.base_sha} base" in command
+
+
 def test_chatgpt_mode_requires_existing_auth_json(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
     missing = tmp_path / "missing-auth.json"
     monkeypatch.setenv("CODEX_AUTH_MODE", "chatgpt")

tests/test_review_format.py

@@ -71,7 +71,7 @@ def test_format_result_comment_appends_missing_config_note_for_system_layout() -
     assert body.endswith("> ℹ️.codex-review.yml is not configured")
 
 
-def test_format_result_comment_does_not_append_missing_config_note_to_agent_markdown() -> None:
+def test_format_result_comment_appends_missing_config_note_to_agent_markdown() -> None:
     body = format_result_comment(
         "ff0011",
         {
@@ -79,4 +79,4 @@ def test_format_result_comment_does_not_append_missing_config_note_to_agent_mark
         },
         repo_configured=False,
     )
-    assert "> ℹ️.codex-review.yml is not configured" not in body
+    assert body.endswith("> ℹ️.codex-review.yml is not configured")