Fix: Ask AI buttons + Checklist Component

[scode2277]

This PR assess the issues related to vocs v2 migration:

• The Ask AI button with Copy page for AI and View as Markdown were both serving 404.
• The Copy page for AI was attaching the sitemap.xml content on top of the page's content.
• The Checklist behavior was broken due it was merged before the migration and it was still trying to act like it was with vocs v1

How everything was fixed:

• The "Ask AI" menu asks for a page's markdown at a plain URL like /governance/overview.md. vocs only answers that URL when a live server is running behind the site. Our site is deployed as plain static files with no server, so the URL returns 404 and the buttons fail. It worked locally only because the dev server provides that missing piece. I fixed it by creating a CF function (_middleware.ts) that moves the markdown files where vocs expects them to be to serve them. I also opened an issue on vocs repo as this should be fixed by them (when they will i will remove the function)
• The vocs version bump fixes the second problem: in the old version every copied page also dragged in the whole site's sitemap. The new version fixes that, so a copy is just the page content.
• For the Checklist behavior, I just made it compatible with vocs v2 by removing the DOM updates at runtime and adding a CSS-based approach with the exact same outcome of before

Thanks @DicksonWu654 for the time put in collecting these :)

Preview Deployment: https://chore-v2-feedback.frameworks-573.pages.dev/

[scode2277]

Regarding the other things in the gdoc that are not assessed here:

• Dark right side / lighter gray content: Keeping this as is. The split is intentional, it separates the navigation from the actual reading area, which is the standard docs layout (and the Vocs default). On top of that, changing the content background isn't a one liner: it throws off the searchbar positioning and cascades into a fair bit of CSS to re-align everything.
• Dropdown menu size: I can see how it reads as a bit small. My reasoning is that it's sized so you can open it, click a tag, and actually watch the sidebar react (even on a smaller screen), since that behavior isn't super obvious. That said, I'll test bumping it up slightly (or changing the dimensions based on the screen size) to see if I can give it a little more breathing room while keeping that sidebar change visible. Will report back.
• ChatGPT / Ask AI button:** Works on my end, though there might be a slight delay before it kicks in. Can you try again and wait a few seconds to see if it actually works or not? (if it doesn't, let me know your default browser too so i can file an issue on vocs repo)
• The weird artefact on the safe-harbor pages: Couldn't reproduce it on either one as not visible on my end. Can you re-check on the preview deployment as it could be solved by the version bump.

@DicksonWu654

[frameworks-volunteer]

Model: z-ai/glm-5.2 Reasoning: medium Provider: openrouter

Security + QA review of PR #529 (Fix: Ask AI buttons + Checklist Component).

3 commits, 5 files changed:

1. components/checklist/Checklist.tsx -- Simplifies checked-state toggling. Removes DOM-wrapping approach in favor of toggling is-checked directly on li. Extracts label text via textContent concatenation. Cleaner, avoids DOM mutation.
2. components/checklist/Checklist.css -- Moves strikethrough/muted to li.is-checked, resets on nested ul/ol children. Prevents cascade into sub-items.
3. functions/_middleware.ts -- New Cloudflare Pages middleware. Rewrites .md requests (excluding /assets/md/) to serve from /assets/md/ path.
4. package.json -- Bumps vocs 2.0.10 -> 2.1.10, waku 1.0.0-beta.1 -> 1.0.0-beta.3
5. pnpm-lock.yaml -- Lock file update.

Security: No hardcoded secrets. Middleware uses url.pathname via new URL() -- no path injection. ASSETS.fetch() scoped to Cloudflare static binding. No eval/innerHTML/dangerouslySetInnerHTML.

QA: Changes align with PR title. CSS reset on nested lists correct. slugify unchanged -- localStorage keys stable. HTMLOListElement check added (was missing). No debug content or TODOs.

Verdict: Approve. No security concerns. Code quality improved -- DOM mutation replaced with simpler class-toggle. Middleware minimal and correct.

(Note: This review was originally analyzed by the relay on 2026-06-25 10:31 but could not be posted due to expired PAT. PAT has been regenerated. Posting now.)