claudetools/.claude/commands/mode.md

/mode — Set or view the current work mode

Manually set the work mode, or let it auto-detect. Mode controls the terminal color and adjusts Claude's operational posture.

Usage

/mode                  Show current mode
/mode client           Switch to client mode (orange)
/mode dev              Switch to development mode (cyan)
/mode infra            Switch to infrastructure mode (red)
/mode general          Switch to general mode (blue)
/mode remediation      Switch to remediation/365 mode (purple)
/mode auto             Re-run auto-detection from current context

Modes

Mode	Color	Posture
client	orange	Working on/for a specific client. Extra care with data handling. Session logs go to clients/<name>/session-logs/. Credential access audited. Always identify the client in session logs.
dev	cyan	Building features, writing code, testing. Delegate freely to Coding/Testing agents. Use Ollama for drafts when available. Less confirmation friction on non-destructive operations.
infra	red	Infrastructure work — servers, firewalls, DNS, deployments, backups. Confirm before any destructive or hard-to-reverse operation. Backup-first mentality. Double-check IPs and hostnames.
general	blue	Research, planning, documentation, email drafts, general questions. Default mode. Lightweight posture.
remediation	purple	M365 tenant work, breach investigation, security remediation. Graph API focus. Compliance-grade language. Full audit trail.

When invoked

1. Set the mode in .claude/identity.json under a "mode" key
2. Run the color change: invoke /color <mode_color>
3. Confirm to user: "Mode: ()"

Auto-detection rules

When /mode auto is called, OR at session start, OR when the user shifts topics, determine mode from context:

Priority order (first match wins):

1. remediation — user said "remediation tool", "365", "breach", "tenant sweep", or /remediation-tool was invoked
2. client — user mentions a client name (check clients/ subdirectories for name matches), or current work is under clients/, or user said "for "
3. infra — user mentions servers by name/IP (AD2, Jupiter, Uranus, pfSense, 172.16.x.x), SSH commands, firewall rules, DNS changes, service restarts, or "deploy to production"
4. dev — user mentions code, building, compiling, Rust/Python/Node, cargo, npm, GuruRMM development, writing features, testing, or current work is under projects/
5. general — default if nothing else matches

On mode change (auto or manual):

• Update .claude/identity.json with "mode": "<mode>"
• Tell the user to run /color <color> — Claude cannot invoke /color programmatically (it's a built-in CLI command). Include the command inline so the user can copy-paste.
• Log the transition: [MODE] general -> infra (detected: SSH to 172.16.3.30) — run /color red

Silent auto-switching: When auto-detection triggers a mode change mid-session, announce it as: [MODE -> infra] /color red — short, actionable, the user can run the color command or ignore it. Don't interrupt flow with a long explanation. If the detection seems wrong, the user can override with /mode <correct_mode>.

Session log integration

Session logs should include the mode in the User section:

## User
- **User:** Mike Swanson (mike)
- **Machine:** DESKTOP-0O8A1RL
- **Role:** admin
- **Mode:** infra (red)

If mode changed during the session, note the transitions:

- **Mode:** general → infra → dev (transitioned during session)