Bug: isPublishCommand matches any argv token — prompts starting with 'publish' hijack session

[dsurchisactive]

Description

The CLI's publish command detection uses process.argv.includes('publish') which matches "publish" anywhere in the arguments, not just as a subcommand. A user prompt like "publish my changes" triggers the publish flow and exits the session.

Root Cause

In cli/src/index.tsx (line 192):

const isLoginCommand = process.argv[2] === 'login'       // ← positional (correct)
const isPublishCommand = process.argv.includes('publish') // ← non-positional (bug)

isLoginCommand correctly checks only argv[2] (the subcommand position), but isPublishCommand uses includes() which matches any argument.

Repro

codebuff "publish my changes"
# Expected: starts a chat session with the prompt "publish my changes"
# Actual: triggers handlePublish() and exits

Impact

Any natural-language prompt or argument containing the word "publish" silently triggers the publish flow instead of starting a chat session.

Suggested Fix

const isPublishCommand = process.argv[2] === 'publish'

Consistent with how isLoginCommand is detected.