feat: add codex review failover and suppress output hardening

src/token-rotation.ts

@@ -7,7 +7,7 @@
  * CLAUDE_CODE_OAUTH_TOKEN if multi-token is not configured.
  *
  * On rate-limit:  rotate to next token
- * All exhausted:  fall through to provider fallback (Kimi etc.)
+ * All exhausted:  surface error to caller
  */
 
 import fs from 'fs';
@@ -153,7 +153,7 @@ export function rotateToken(
         cooldownUntil != null ? new Date(cooldownUntil).toISOString() : null,
       reason: errorMessage ?? null,
     },
-    'All tokens are rate-limited, falling through to provider fallback',
+    'All tokens are rate-limited, no available tokens',
   );
   return false;
 }
@@ -234,3 +234,13 @@ export function getTokenRotationInfo(): {
     ).length,
   };
 }
+
+export function hasAvailableClaudeToken(): boolean {
+  if (tokens.length === 0) {
+    return Boolean(process.env.CLAUDE_CODE_OAUTH_TOKEN);
+  }
+  const now = Date.now();
+  return tokens.some(
+    (token) => !token.rateLimitedUntil || token.rateLimitedUntil <= now,
+  );
+}