---
name: mode
description: >
  Manually set the work mode (remediation, client, infra, dev, general), or let it auto-detect. Mode controls terminal color, operational posture, and hook behavior (e.g. lock checking in dev mode). Use when the user says /mode, "set mode to infra", "work in client mode for <client>", "switch to remediation".
---

# /mode — Work Mode Control

Controls the current work mode for this session.

**Grok implementation:** See `.claude/commands/mode.md` for the full command logic and auto-detection rules.

Key modes (from CLAUDE.md):
- remediation: M365 / breach / tenant sweep focus, Graph API, full audit.
- client: Careful with data, session logs go under clients/<name>/, name the client.
- infra: Confirm before destructive ops, backup-first, server/SSH/firewall/DNS.
- dev: Delegate freely (Coding/Explore/Review agents), less confirmation for code work.
- general: Lightweight default.

**Actions when mode changes:**
- Announce `[MODE -> <new>]`
- Tell user to run `/color <color>` if applicable.
- **MANDATORY:** Write the new mode to `.claude/current-mode` (use relative path or forward slashes on Windows/Git Bash; the block-backslash hook protects this).
  Example: `echo dev > .claude/current-mode`

The UserPromptSubmit hook (both Claude and our .grok/hooks) reads this file to decide whether to show active locks etc.

When this skill is active:
- Read `.claude/commands/mode.md` and the Work Mode section of CLAUDE.md.
- Use `run_terminal_command` (with proper bash) to write the file.
- Update any in-memory state.

Auto-detect on first user message using keywords (client names, "365", "remediation tool", server names, "for <client>", code/Rust keywords, etc.). First match wins.

See also `.claude/current-mode` (gitignored machine-local file).