Process starts
    │
    ▼
main.tsx (top-level side effects)
    ├─ profileCheckpoint('main_tsx_entry')
    ├─ startMdmRawRead()        — parallel MDM subprocess (macOS)
    ├─ startKeychainPrefetch()  — parallel keychain reads (macOS)
    │
    ▼
main.tsx imports (~135ms of module evaluation)
    │
    ▼
main() function
    ├─ Security: NoDefaultCurrentDirectoryInExePath (Windows)
    ├─ Initialize warning handler
    ├─ Handle deep link URIs (cc://, cc+unix://, --handle-uri)
    ├─ Handle `claude assistant [sessionId]` (KAIROS feature)
    ├─ Handle `claude ssh <host> [dir]` (SSH_REMOTE feature)
    ├─ Determine interactive vs non-interactive mode
    ├─ Set client type (cli, sdk-cli, github-action, remote, etc.)
    ├─ Eager-load settings from --settings flag
    │
    ▼
run() — Commander.js CLI setup
    │
    ▼
preAction hook (fires when a command executes)
    ├─ await MDM + keychain prefetches
    ├─ init() — core initialization
    ├─ process.title = 'claude'
    ├─ initSinks() — logging/analytics sinks
    ├─ Wire --plugin-dir to inline plugins
    ├─ runMigrations() — settings migrations
    ├─ loadRemoteManagedSettings() (non-blocking)
    ├─ loadPolicyLimits() (non-blocking)
    └─ Upload user settings (if enabled)
    │
    ▼
Default command handler
    ├─ setup() — session initialization
    └─ render REPL or run headless