# /mode — Set or view the current work mode

Manually set the work mode, or let it auto-detect. Mode controls the terminal color and adjusts Claude's operational posture.

## Usage

```
/mode                  Show current mode
/mode client           Switch to client mode (orange)
/mode dev              Switch to development mode (cyan)
/mode infra            Switch to infrastructure mode (red)
/mode general          Switch to general mode (blue)
/mode remediation      Switch to remediation/365 mode (purple)
/mode auto             Re-run auto-detection from current context
```

## Modes

| Mode | Color | Posture |
|---|---|---|
| **client** | orange | Working on/for a specific client. Extra care with data handling. Session logs go to `clients/<name>/session-logs/`. Credential access audited. Always identify the client in session logs. |
| **dev** | cyan | Building features, writing code, testing. Delegate freely to Coding/Testing agents. Use Ollama for drafts when available. Less confirmation friction on non-destructive operations. |
| **infra** | red | Infrastructure work — servers, firewalls, DNS, deployments, backups. Confirm before any destructive or hard-to-reverse operation. Backup-first mentality. Double-check IPs and hostnames. |
| **general** | blue | Research, planning, documentation, email drafts, general questions. Default mode. Lightweight posture. |
| **remediation** | purple | M365 tenant work, breach investigation, security remediation. Graph API focus. Compliance-grade language. Full audit trail. |

## When invoked

1. Set the mode in `.claude/identity.json` under a `"mode"` key
2. Run the color change: invoke `/color <mode_color>`
3. Confirm to user: "Mode: **<mode>** (<color>)"

## Auto-detection rules

When `/mode auto` is called, OR at session start, OR when the user shifts topics, determine mode from context:

**Priority order (first match wins):**

1. **remediation** — user said "remediation tool", "365", "breach", "tenant sweep", or `/remediation-tool` was invoked
2. **client** — user mentions a client name (check `clients/` subdirectories for name matches), or current work is under `clients/`, or user said "for <client>"
3. **infra** — user mentions servers by name/IP (AD2, Jupiter, Uranus, pfSense, 172.16.x.x), SSH commands, firewall rules, DNS changes, service restarts, or "deploy to production"
4. **dev** — user mentions code, building, compiling, Rust/Python/Node, cargo, npm, GuruRMM development, writing features, testing, or current work is under `projects/`
5. **general** — default if nothing else matches

**On mode change (auto or manual):**
- Update `.claude/identity.json` with `"mode": "<mode>"`
- **Tell the user to run `/color <color>`** — Claude cannot invoke `/color` programmatically (it's a built-in CLI command). Include the command inline so the user can copy-paste.
- Log the transition: `[MODE] general -> infra (detected: SSH to 172.16.3.30) — run /color red`

**Silent auto-switching:** When auto-detection triggers a mode change mid-session, announce it as: `[MODE -> infra] /color red` — short, actionable, the user can run the color command or ignore it. Don't interrupt flow with a long explanation. If the detection seems wrong, the user can override with `/mode <correct_mode>`.

## Session log integration

Session logs should include the mode in the User section:

```markdown
## User
- **User:** Mike Swanson (mike)
- **Machine:** DESKTOP-0O8A1RL
- **Role:** admin
- **Mode:** infra (red)
```

If mode changed during the session, note the transitions:

```markdown
- **Mode:** general → infra → dev (transitioned during session)
```