fix: gate eval routes behind eval-only flag and fix flue() ordering

Author: mvvmm

.flue/app.ts

@@ -44,6 +44,7 @@ setProvider(
 type WebhookEnv = PipelineEnv & {
 	GITHUB_WEBHOOK_SECRET?: string;
 	DOCS_FLUE_INTERNAL_TOKEN?: string;
+	DOCS_FLUE_ENABLE_EVAL_ROUTES?: string;
 };
 
 const app = new Hono();
@@ -142,10 +143,11 @@ app.post("/webhooks/github", async (c) => {
 
 // ── Eval routes ─────────────────────────────────────────────────────────────
 // Mount each reviewable agent behind a shared internal-token gate so
-// vitest-evals can drive them over HTTP during CI. The token reuses
-// DOCS_FLUE_INTERNAL_TOKEN (same gate as /dev/review/:number). Routes return
-// 404 when the token is unset so they are invisible in production deploys
-// that have not opted in.
+// vitest-evals can drive them over HTTP during CI. Requires both
+// DOCS_FLUE_ENABLE_EVAL_ROUTES=1 and DOCS_FLUE_INTERNAL_TOKEN to be set in
+// the Worker env. The Vite config only injects these during eval runs
+// (DOCS_FLUE_AGENT_EVALS=1), so eval routes are never live in production or
+// normal dev.
 const EVAL_AGENTS = [
 	CodeReviewFile,
 	StyleGuideFile,
@@ -156,6 +158,7 @@ const EVAL_AGENTS = [
 
 app.use("/eval/agents/*", async (c, next) => {
 	const env = c.env as unknown as WebhookEnv;
+	if (env.DOCS_FLUE_ENABLE_EVAL_ROUTES !== "1") return c.text("Not Found", 404);
 	const secret = env.DOCS_FLUE_INTERNAL_TOKEN;
 	if (!secret) return c.text("Not Found", 404);
 	const provided = c.req.header("x-dev-secret");

.flue/bin/run-evals.ts

@@ -54,6 +54,7 @@ async function main() {
 	const env = {
 		...process.env,
 		DOCS_FLUE_INTERNAL_TOKEN: TOKEN,
+		DOCS_FLUE_AGENT_EVALS: "1",
 	};
 
 	// Start the dev server. The Vite config reads DOCS_FLUE_INTERNAL_TOKEN

.flue/vite.config.ts

@@ -13,19 +13,25 @@ import { defineConfig } from "vite";
 //
 // The wrapped customizer also forwards DOCS_FLUE_INTERNAL_TOKEN from
 // process.env into the Worker's vars so eval routes work in CI without .env.
+// This only activates when DOCS_FLUE_AGENT_EVALS=1 is set (by run-evals.ts),
+// so normal dev/build/deploy are unaffected.
+const fluePlugin = flue();
 const flueCustomizer = flueWorkerConfig();
 
 export default defineConfig({
 	plugins: [
-		flue(),
+		fluePlugin,
 		cloudflare({
 			config: (config) => {
 				flueCustomizer(config);
-				const token = process.env.DOCS_FLUE_INTERNAL_TOKEN;
-				if (token) {
+				if (
+					process.env.DOCS_FLUE_AGENT_EVALS === "1" &&
+					process.env.DOCS_FLUE_INTERNAL_TOKEN
+				) {
 					(config as Record<string, unknown>).vars = {
 						...((config as Record<string, unknown>).vars ?? {}),
-						DOCS_FLUE_INTERNAL_TOKEN: token,
+						DOCS_FLUE_INTERNAL_TOKEN: process.env.DOCS_FLUE_INTERNAL_TOKEN,
+						DOCS_FLUE_ENABLE_EVAL_ROUTES: "1",
 					};
 				}
 			},