feat: deprecate destroy and introduce remove all + deploy teardown flow

README.md

@@ -85,7 +85,6 @@ agentcore invoke --stream
 | `validate` | Validate configuration files |
 | `deploy` | Deploy infrastructure to AWS |
 | `status` | Check deployment status |
-| `destroy` | Tear down deployed resources |
 
 ### Resource Management
 

docs/commands.md

@@ -65,21 +65,6 @@ agentcore deploy -v --json # Verbose JSON output
 | `-v, --verbose` | Resource-level events |
 | `--json` | JSON output |
 
-### destroy
-
-Tear down deployed resources.
-
-```bash
-agentcore destroy
-agentcore destroy --target dev -y # Auto-confirm
-```
-
-| Flag | Description |
-| ----------------- | ----------------- |
-| `--target <name>` | Target to destroy |
-| `-y, --yes` | Skip confirmation |
-| `--json` | JSON output |
-
 ### status
 
 Check deployment status.

integ-tests/deploy.test.ts

@@ -83,17 +83,17 @@ describe('integration: deploy', () => {
  }, 120000);
 
  afterAll(async () => {
- // Destroy resources and verify it succeeds
+ // Tear down deployed resources: remove all agents, then deploy --yes to destroy the stack
  if (projectPath && hasAws) {
- const result = await runCLI(['destroy', '--target', targetName, '--yes', '--json'], projectPath, false);
+ await runCLI(['remove', 'all', '--json'], projectPath, false);
+ const result = await runCLI(['deploy', '--target', targetName, '--yes', '--json'], projectPath, false);
 
- // Assert destroy succeeded
- expect(result.exitCode, `Destroy failed: ${result.stderr}`).toBe(0);
+ expect(result.exitCode, `Teardown failed: ${result.stderr}`).toBe(0);
  const json = JSON.parse(result.stdout);
- expect(json.success, 'Destroy should report success').toBe(true);
+ expect(json.success, 'Teardown should report success').toBe(true);
  }
  await rm(testDir, { recursive: true, force: true });
- }, 120000);
+ }, 300000);
 
  it.skipIf(!hasNpm || !hasGit || !hasUv || !hasAws)(
  'deploys to AWS successfully',

integ-tests/help.test.ts

@@ -6,7 +6,6 @@ const COMMANDS = [
  'deploy',
  'dev',
  'invoke',
- 'destroy',
  'status',
  'validate',
  'add',

src/cli/cli.ts

@@ -1,7 +1,6 @@
 import { registerAdd } from './commands/add';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
-import { registerDestroy } from './commands/destroy';
 import { registerDev } from './commands/dev';
 import { registerHelp } from './commands/help';
 import { registerInvoke } from './commands/invoke';
@@ -120,7 +119,6 @@ export function registerCommands(program: Command) {
  registerAdd(program);
  registerDev(program);
  registerDeploy(program);
- registerDestroy(program);
  registerCreate(program);
  registerHelp(program);
  registerInvoke(program);

src/cli/commands/deploy/__tests__/deploy-teardown.test.ts

@@ -0,0 +1,107 @@
+import { runCLI } from '../../../../test-utils/index.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('destroy command removed', () => {
+ it('destroy does not appear as a command in help output', async () => {
+ const result = await runCLI(['--help'], process.cwd());
+ expect(result.exitCode).toBe(0);
+ // Verify 'destroy' is not listed as a command
+ // Extract the commands section and check no line starts with destroy
+ const lines = result.stdout.split('\n').map(l => l.trim());
+ const commandLines = lines.filter(l => /^\w/.test(l));
+ expect(commandLines.some(l => l.startsWith('destroy'))).toBe(false);
+ });
+});
+
+describe('deploy with empty agents and deployed state (teardown)', () => {
+ let testDir: string;
+ let projectDir: string;
+
+ beforeAll(async () => {
+ testDir = join(tmpdir(), `agentcore-deploy-teardown-${randomUUID()}`);
+ await mkdir(testDir, { recursive: true });
+
+ // Create project without agents
+ const projectName = 'TeardownTestProj';
+ const result = await runCLI(['create', '--name', projectName, '--no-agent'], testDir);
+ if (result.exitCode !== 0) {
+ throw new Error(`Failed to create project: ${result.stdout} ${result.stderr}`);
+ }
+ projectDir = join(testDir, projectName);
+
+ // Add a target
+ const targetResult = await runCLI(
+ ['add', 'target', '--name', 'test-target', '--account', '123456789012', '--region', 'us-east-1', '--json'],
+ projectDir
+ );
+ if (targetResult.exitCode !== 0) {
+ throw new Error(`Failed to create target: ${targetResult.stdout} ${targetResult.stderr}`);
+ }
+ });
+
+ afterAll(async () => {
+ await rm(testDir, { recursive: true, force: true });
+ });
+
+ it('rejects deploy when no agents and no deployed state', async () => {
+ // With no agents and empty deployed-state, deploy should fail with "no agents" error
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ expect(result.exitCode).toBe(1);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('no agents');
+ });
+
+ it('requires --yes to confirm teardown deploy when deployed state exists', async () => {
+ // Simulate that a previous deploy happened by writing to deployed-state.json
+ // deployed-state.json lives in agentcore/.cli/
+ const cliDir = join(projectDir, 'agentcore', '.cli');
+ await mkdir(cliDir, { recursive: true });
+ const deployedStatePath = join(cliDir, 'deployed-state.json');
+ await writeFile(
+ deployedStatePath,
+ JSON.stringify({
+ targets: {
+ 'test-target': {
+ resources: {
+ stackName: 'TeardownTestProj-test-target',
+ agents: {
+ OldAgent: {
+ runtimeId: 'rt-123',
+ runtimeArn: 'arn:aws:agentcore:us-east-1:123456789012:runtime/rt-123',
+ roleArn: 'arn:aws:iam::123456789012:role/test-role',
+ },
+ },
+ },
+ },
+ },
+ })
+ );
+
+ // Without --yes, deploy should fail asking for confirmation
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('teardown');
+ expect(json.error).toContain('--yes');
+ }, 90000);
+
+ it('allows teardown deploy with --yes flag when deployed state exists', async () => {
+ // With --yes, deploy should proceed past the teardown confirmation
+ // It will eventually fail on AWS/CDK (no real credentials), but NOT on "no agents" or "teardown"
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json', '--yes'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(
+ !json.error?.toLowerCase().includes('no agents'),
+ `Should not fail with "no agents" when deployed state exists. Got: ${json.error}`
+ ).toBe(true);
+ expect(
+ !json.error?.toLowerCase().includes('teardown'),
+ `Should not fail with teardown confirmation when --yes is passed. Got: ${json.error}`
+ ).toBe(true);
+ }, 90000);
+});

src/cli/commands/deploy/actions.ts

@@ -1,4 +1,5 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
+import { validateAwsCredentials } from '../../aws/account';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import { buildDeployedState, getStackOutputs, parseAgentOutputs } from '../../cloudformation';
 import { getErrorMessage } from '../../errors';
@@ -10,6 +11,7 @@ import {
  checkStackDeployability,
  getAllCredentials,
  hasOwnedIdentityApiProviders,
+ performStackTeardown,
  setupApiKeyProviders,
  synthesizeCdk,
  validateProject,
@@ -67,6 +69,24 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
  const context = await validateProject();
  endStep('success');
 
+ // Teardown confirmation: if this is a teardown deploy, require --yes
+ if (context.isTeardownDeploy && !options.autoConfirm) {
+ logger.finalize(false);
+ return {
+ success: false,
+ error:
+ 'This will delete all deployed resources and the CloudFormation stack. Run with --yes to confirm teardown.',
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
+ // Validate AWS credentials (deferred for teardown deploys until after confirmation)
+ if (context.isTeardownDeploy) {
+ startStep('Validate AWS credentials');
+ await validateAwsCredentials();
+ endStep('success');
+ }
+
  // Ensure L3 constructs are linked (for local development)
  startStep('Link L3 constructs');
  await context.cdkProject.ensureL3Link();
@@ -195,6 +215,31 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
  endStep('success');
 
+ if (context.isTeardownDeploy) {
+ // After deploying the empty spec, destroy the stack entirely
+ startStep('Tear down stack');
+ const teardown = await performStackTeardown(target.name);
+ if (!teardown.success) {
+ endStep('error', teardown.error);
+ logger.finalize(false);
+ return {
+ success: false,
+ error: `Stack teardown failed: ${teardown.error}`,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+ endStep('success');
+
+ logger.finalize(true);
+
+ return {
+ success: true,
+ targetName: target.name,
+ stackName,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
  // Get stack outputs and persist state
  startStep('Persist deployment state');
  const outputs = await getStackOutputs(target.region, stackName);

README.md

@@ -85,7 +85,6 @@ agentcore invoke --stream
 | `validate` | Validate configuration files |
 | `deploy` | Deploy infrastructure to AWS |
 | `status` | Check deployment status |
-| `destroy` | Tear down deployed resources |
 
 ### Resource Management
 

docs/commands.md

@@ -65,21 +65,6 @@ agentcore deploy -v --json # Verbose JSON output
 | `-v, --verbose` | Resource-level events |
 | `--json` | JSON output |
 
-### destroy
-
-Tear down deployed resources.
-
-```bash
-agentcore destroy
-agentcore destroy --target dev -y # Auto-confirm
-```
-
-| Flag | Description |
-| ----------------- | ----------------- |
-| `--target <name>` | Target to destroy |
-| `-y, --yes` | Skip confirmation |
-| `--json` | JSON output |
-
 ### status
 
 Check deployment status.

integ-tests/deploy.test.ts

@@ -83,17 +83,17 @@ describe('integration: deploy', () => {
  }, 120000);
 
  afterAll(async () => {
- // Destroy resources and verify it succeeds
+ // Tear down deployed resources: remove all agents, then deploy --yes to destroy the stack
  if (projectPath && hasAws) {
- const result = await runCLI(['destroy', '--target', targetName, '--yes', '--json'], projectPath, false);
+ await runCLI(['remove', 'all', '--json'], projectPath, false);
+ const result = await runCLI(['deploy', '--target', targetName, '--yes', '--json'], projectPath, false);
 
- // Assert destroy succeeded
- expect(result.exitCode, `Destroy failed: ${result.stderr}`).toBe(0);
+ expect(result.exitCode, `Teardown failed: ${result.stderr}`).toBe(0);
  const json = JSON.parse(result.stdout);
- expect(json.success, 'Destroy should report success').toBe(true);
+ expect(json.success, 'Teardown should report success').toBe(true);
  }
  await rm(testDir, { recursive: true, force: true });
- }, 120000);
+ }, 300000);
 
  it.skipIf(!hasNpm || !hasGit || !hasUv || !hasAws)(
  'deploys to AWS successfully',

integ-tests/help.test.ts

@@ -6,7 +6,6 @@ const COMMANDS = [
  'deploy',
  'dev',
  'invoke',
- 'destroy',
  'status',
  'validate',
  'add',

src/cli/cli.ts

@@ -1,7 +1,6 @@
 import { registerAdd } from './commands/add';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
-import { registerDestroy } from './commands/destroy';
 import { registerDev } from './commands/dev';
 import { registerHelp } from './commands/help';
 import { registerInvoke } from './commands/invoke';
@@ -120,7 +119,6 @@ export function registerCommands(program: Command) {
  registerAdd(program);
  registerDev(program);
  registerDeploy(program);
- registerDestroy(program);
  registerCreate(program);
  registerHelp(program);
  registerInvoke(program);

src/cli/commands/deploy/__tests__/deploy-teardown.test.ts

@@ -0,0 +1,107 @@
+import { runCLI } from '../../../../test-utils/index.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('destroy command removed', () => {
+ it('destroy does not appear as a command in help output', async () => {
+ const result = await runCLI(['--help'], process.cwd());
+ expect(result.exitCode).toBe(0);
+ // Verify 'destroy' is not listed as a command
+ // Extract the commands section and check no line starts with destroy
+ const lines = result.stdout.split('\n').map(l => l.trim());
+ const commandLines = lines.filter(l => /^\w/.test(l));
+ expect(commandLines.some(l => l.startsWith('destroy'))).toBe(false);
+ });
+});
+
+describe('deploy with empty agents and deployed state (teardown)', () => {
+ let testDir: string;
+ let projectDir: string;
+
+ beforeAll(async () => {
+ testDir = join(tmpdir(), `agentcore-deploy-teardown-${randomUUID()}`);
+ await mkdir(testDir, { recursive: true });
+
+ // Create project without agents
+ const projectName = 'TeardownTestProj';
+ const result = await runCLI(['create', '--name', projectName, '--no-agent'], testDir);
+ if (result.exitCode !== 0) {
+ throw new Error(`Failed to create project: ${result.stdout} ${result.stderr}`);
+ }
+ projectDir = join(testDir, projectName);
+
+ // Add a target
+ const targetResult = await runCLI(
+ ['add', 'target', '--name', 'test-target', '--account', '123456789012', '--region', 'us-east-1', '--json'],
+ projectDir
+ );
+ if (targetResult.exitCode !== 0) {
+ throw new Error(`Failed to create target: ${targetResult.stdout} ${targetResult.stderr}`);
+ }
+ });
+
+ afterAll(async () => {
+ await rm(testDir, { recursive: true, force: true });
+ });
+
+ it('rejects deploy when no agents and no deployed state', async () => {
+ // With no agents and empty deployed-state, deploy should fail with "no agents" error
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ expect(result.exitCode).toBe(1);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('no agents');
+ });
+
+ it('requires --yes to confirm teardown deploy when deployed state exists', async () => {
+ // Simulate that a previous deploy happened by writing to deployed-state.json
+ // deployed-state.json lives in agentcore/.cli/
+ const cliDir = join(projectDir, 'agentcore', '.cli');
+ await mkdir(cliDir, { recursive: true });
+ const deployedStatePath = join(cliDir, 'deployed-state.json');
+ await writeFile(
+ deployedStatePath,
+ JSON.stringify({
+ targets: {
+ 'test-target': {
+ resources: {
+ stackName: 'TeardownTestProj-test-target',
+ agents: {
+ OldAgent: {
+ runtimeId: 'rt-123',
+ runtimeArn: 'arn:aws:agentcore:us-east-1:123456789012:runtime/rt-123',
+ roleArn: 'arn:aws:iam::123456789012:role/test-role',
+ },
+ },
+ },
+ },
+ },
+ })
+ );
+
+ // Without --yes, deploy should fail asking for confirmation
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('teardown');
+ expect(json.error).toContain('--yes');
+ }, 90000);
+
+ it('allows teardown deploy with --yes flag when deployed state exists', async () => {
+ // With --yes, deploy should proceed past the teardown confirmation
+ // It will eventually fail on AWS/CDK (no real credentials), but NOT on "no agents" or "teardown"
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json', '--yes'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(
+ !json.error?.toLowerCase().includes('no agents'),
+ `Should not fail with "no agents" when deployed state exists. Got: ${json.error}`
+ ).toBe(true);
+ expect(
+ !json.error?.toLowerCase().includes('teardown'),
+ `Should not fail with teardown confirmation when --yes is passed. Got: ${json.error}`
+ ).toBe(true);
+ }, 90000);
+});

src/cli/commands/deploy/actions.ts

@@ -1,4 +1,5 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
+import { validateAwsCredentials } from '../../aws/account';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import { buildDeployedState, getStackOutputs, parseAgentOutputs } from '../../cloudformation';
 import { getErrorMessage } from '../../errors';
@@ -10,6 +11,7 @@ import {
  checkStackDeployability,
  getAllCredentials,
  hasOwnedIdentityApiProviders,
+ performStackTeardown,
  setupApiKeyProviders,
  synthesizeCdk,
  validateProject,
@@ -67,6 +69,24 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
  const context = await validateProject();
  endStep('success');
 
+ // Teardown confirmation: if this is a teardown deploy, require --yes
+ if (context.isTeardownDeploy && !options.autoConfirm) {
+ logger.finalize(false);
+ return {
+ success: false,
+ error:
+ 'This will delete all deployed resources and the CloudFormation stack. Run with --yes to confirm teardown.',
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
+ // Validate AWS credentials (deferred for teardown deploys until after confirmation)
+ if (context.isTeardownDeploy) {
+ startStep('Validate AWS credentials');
+ await validateAwsCredentials();
+ endStep('success');
+ }
+
  // Ensure L3 constructs are linked (for local development)
  startStep('Link L3 constructs');
  await context.cdkProject.ensureL3Link();
@@ -195,6 +215,31 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
  endStep('success');
 
+ if (context.isTeardownDeploy) {
+ // After deploying the empty spec, destroy the stack entirely
+ startStep('Tear down stack');
+ const teardown = await performStackTeardown(target.name);
+ if (!teardown.success) {
+ endStep('error', teardown.error);
+ logger.finalize(false);
+ return {
+ success: false,
+ error: `Stack teardown failed: ${teardown.error}`,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+ endStep('success');
+
+ logger.finalize(true);
+
+ return {
+ success: true,
+ targetName: target.name,
+ stackName,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
  // Get stack outputs and persist state
  startStep('Persist deployment state');
  const outputs = await getStackOutputs(target.region, stackName);

README.md

@@ -85,7 +85,6 @@ agentcore invoke --stream
 | `validate` | Validate configuration files |
 | `deploy` | Deploy infrastructure to AWS |
 | `status` | Check deployment status |
-| `destroy` | Tear down deployed resources |
 
 ### Resource Management
 

docs/commands.md

@@ -65,21 +65,6 @@ agentcore deploy -v --json # Verbose JSON output
 | `-v, --verbose` | Resource-level events |
 | `--json` | JSON output |
 
-### destroy
-
-Tear down deployed resources.
-
-```bash
-agentcore destroy
-agentcore destroy --target dev -y # Auto-confirm
-```
-
-| Flag | Description |
-| ----------------- | ----------------- |
-| `--target <name>` | Target to destroy |
-| `-y, --yes` | Skip confirmation |
-| `--json` | JSON output |
-
 ### status
 
 Check deployment status.

integ-tests/deploy.test.ts

@@ -83,17 +83,17 @@ describe('integration: deploy', () => {
  }, 120000);
 
  afterAll(async () => {
- // Destroy resources and verify it succeeds
+ // Tear down deployed resources: remove all agents, then deploy --yes to destroy the stack
  if (projectPath && hasAws) {
- const result = await runCLI(['destroy', '--target', targetName, '--yes', '--json'], projectPath, false);
+ await runCLI(['remove', 'all', '--json'], projectPath, false);
+ const result = await runCLI(['deploy', '--target', targetName, '--yes', '--json'], projectPath, false);
 
- // Assert destroy succeeded
- expect(result.exitCode, `Destroy failed: ${result.stderr}`).toBe(0);
+ expect(result.exitCode, `Teardown failed: ${result.stderr}`).toBe(0);
  const json = JSON.parse(result.stdout);
- expect(json.success, 'Destroy should report success').toBe(true);
+ expect(json.success, 'Teardown should report success').toBe(true);
  }
  await rm(testDir, { recursive: true, force: true });
- }, 120000);
+ }, 300000);
 
  it.skipIf(!hasNpm || !hasGit || !hasUv || !hasAws)(
  'deploys to AWS successfully',

integ-tests/help.test.ts

@@ -6,7 +6,6 @@ const COMMANDS = [
  'deploy',
  'dev',
  'invoke',
- 'destroy',
  'status',
  'validate',
  'add',

src/cli/cli.ts

@@ -1,7 +1,6 @@
 import { registerAdd } from './commands/add';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
-import { registerDestroy } from './commands/destroy';
 import { registerDev } from './commands/dev';
 import { registerHelp } from './commands/help';
 import { registerInvoke } from './commands/invoke';
@@ -120,7 +119,6 @@ export function registerCommands(program: Command) {
  registerAdd(program);
  registerDev(program);
  registerDeploy(program);
- registerDestroy(program);
  registerCreate(program);
  registerHelp(program);
  registerInvoke(program);

src/cli/commands/deploy/__tests__/deploy-teardown.test.ts

@@ -0,0 +1,107 @@
+import { runCLI } from '../../../../test-utils/index.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('destroy command removed', () => {
+ it('destroy does not appear as a command in help output', async () => {
+ const result = await runCLI(['--help'], process.cwd());
+ expect(result.exitCode).toBe(0);
+ // Verify 'destroy' is not listed as a command
+ // Extract the commands section and check no line starts with destroy
+ const lines = result.stdout.split('\n').map(l => l.trim());
+ const commandLines = lines.filter(l => /^\w/.test(l));
+ expect(commandLines.some(l => l.startsWith('destroy'))).toBe(false);
+ });
+});
+
+describe('deploy with empty agents and deployed state (teardown)', () => {
+ let testDir: string;
+ let projectDir: string;
+
+ beforeAll(async () => {
+ testDir = join(tmpdir(), `agentcore-deploy-teardown-${randomUUID()}`);
+ await mkdir(testDir, { recursive: true });
+
+ // Create project without agents
+ const projectName = 'TeardownTestProj';
+ const result = await runCLI(['create', '--name', projectName, '--no-agent'], testDir);
+ if (result.exitCode !== 0) {
+ throw new Error(`Failed to create project: ${result.stdout} ${result.stderr}`);
+ }
+ projectDir = join(testDir, projectName);
+
+ // Add a target
+ const targetResult = await runCLI(
+ ['add', 'target', '--name', 'test-target', '--account', '123456789012', '--region', 'us-east-1', '--json'],
+ projectDir
+ );
+ if (targetResult.exitCode !== 0) {
+ throw new Error(`Failed to create target: ${targetResult.stdout} ${targetResult.stderr}`);
+ }
+ });
+
+ afterAll(async () => {
+ await rm(testDir, { recursive: true, force: true });
+ });
+
+ it('rejects deploy when no agents and no deployed state', async () => {
+ // With no agents and empty deployed-state, deploy should fail with "no agents" error
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ expect(result.exitCode).toBe(1);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('no agents');
+ });
+
+ it('requires --yes to confirm teardown deploy when deployed state exists', async () => {
+ // Simulate that a previous deploy happened by writing to deployed-state.json
+ // deployed-state.json lives in agentcore/.cli/
+ const cliDir = join(projectDir, 'agentcore', '.cli');
+ await mkdir(cliDir, { recursive: true });
+ const deployedStatePath = join(cliDir, 'deployed-state.json');
+ await writeFile(
+ deployedStatePath,
+ JSON.stringify({
+ targets: {
+ 'test-target': {
+ resources: {
+ stackName: 'TeardownTestProj-test-target',
+ agents: {
+ OldAgent: {
+ runtimeId: 'rt-123',
+ runtimeArn: 'arn:aws:agentcore:us-east-1:123456789012:runtime/rt-123',
+ roleArn: 'arn:aws:iam::123456789012:role/test-role',
+ },
+ },
+ },
+ },
+ },
+ })
+ );
+
+ // Without --yes, deploy should fail asking for confirmation
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('teardown');
+ expect(json.error).toContain('--yes');
+ }, 90000);
+
+ it('allows teardown deploy with --yes flag when deployed state exists', async () => {
+ // With --yes, deploy should proceed past the teardown confirmation
+ // It will eventually fail on AWS/CDK (no real credentials), but NOT on "no agents" or "teardown"
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json', '--yes'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(
+ !json.error?.toLowerCase().includes('no agents'),
+ `Should not fail with "no agents" when deployed state exists. Got: ${json.error}`
+ ).toBe(true);
+ expect(
+ !json.error?.toLowerCase().includes('teardown'),
+ `Should not fail with teardown confirmation when --yes is passed. Got: ${json.error}`
+ ).toBe(true);
+ }, 90000);
+});

src/cli/commands/deploy/actions.ts

@@ -1,4 +1,5 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
+import { validateAwsCredentials } from '../../aws/account';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import { buildDeployedState, getStackOutputs, parseAgentOutputs } from '../../cloudformation';
 import { getErrorMessage } from '../../errors';
@@ -10,6 +11,7 @@ import {
  checkStackDeployability,
  getAllCredentials,
  hasOwnedIdentityApiProviders,
+ performStackTeardown,
  setupApiKeyProviders,
  synthesizeCdk,
  validateProject,
@@ -67,6 +69,24 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
  const context = await validateProject();
  endStep('success');
 
+ // Teardown confirmation: if this is a teardown deploy, require --yes
+ if (context.isTeardownDeploy && !options.autoConfirm) {
+ logger.finalize(false);
+ return {
+ success: false,
+ error:
+ 'This will delete all deployed resources and the CloudFormation stack. Run with --yes to confirm teardown.',
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
+ // Validate AWS credentials (deferred for teardown deploys until after confirmation)
+ if (context.isTeardownDeploy) {
+ startStep('Validate AWS credentials');
+ await validateAwsCredentials();
+ endStep('success');
+ }
+
  // Ensure L3 constructs are linked (for local development)
  startStep('Link L3 constructs');
  await context.cdkProject.ensureL3Link();
@@ -195,6 +215,31 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
  endStep('success');
 
+ if (context.isTeardownDeploy) {
+ // After deploying the empty spec, destroy the stack entirely
+ startStep('Tear down stack');
+ const teardown = await performStackTeardown(target.name);
+ if (!teardown.success) {
+ endStep('error', teardown.error);
+ logger.finalize(false);
+ return {
+ success: false,
+ error: `Stack teardown failed: ${teardown.error}`,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+ endStep('success');
+
+ logger.finalize(true);
+
+ return {
+ success: true,
+ targetName: target.name,
+ stackName,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
  // Get stack outputs and persist state
  startStep('Persist deployment state');
  const outputs = await getStackOutputs(target.region, stackName);

README.md

@@ -85,7 +85,6 @@ agentcore invoke --stream
 | `validate` | Validate configuration files |
 | `deploy` | Deploy infrastructure to AWS |
 | `status` | Check deployment status |
-| `destroy` | Tear down deployed resources |
 
 ### Resource Management
 

docs/commands.md

@@ -65,21 +65,6 @@ agentcore deploy -v --json # Verbose JSON output
 | `-v, --verbose` | Resource-level events |
 | `--json` | JSON output |
 
-### destroy
-
-Tear down deployed resources.
-
-```bash
-agentcore destroy
-agentcore destroy --target dev -y # Auto-confirm
-```
-
-| Flag | Description |
-| ----------------- | ----------------- |
-| `--target <name>` | Target to destroy |
-| `-y, --yes` | Skip confirmation |
-| `--json` | JSON output |
-
 ### status
 
 Check deployment status.

integ-tests/deploy.test.ts

@@ -83,17 +83,17 @@ describe('integration: deploy', () => {
  }, 120000);
 
  afterAll(async () => {
- // Destroy resources and verify it succeeds
+ // Tear down deployed resources: remove all agents, then deploy --yes to destroy the stack
  if (projectPath && hasAws) {
- const result = await runCLI(['destroy', '--target', targetName, '--yes', '--json'], projectPath, false);
+ await runCLI(['remove', 'all', '--json'], projectPath, false);
+ const result = await runCLI(['deploy', '--target', targetName, '--yes', '--json'], projectPath, false);
 
- // Assert destroy succeeded
- expect(result.exitCode, `Destroy failed: ${result.stderr}`).toBe(0);
+ expect(result.exitCode, `Teardown failed: ${result.stderr}`).toBe(0);
  const json = JSON.parse(result.stdout);
- expect(json.success, 'Destroy should report success').toBe(true);
+ expect(json.success, 'Teardown should report success').toBe(true);
  }
  await rm(testDir, { recursive: true, force: true });
- }, 120000);
+ }, 300000);
 
  it.skipIf(!hasNpm || !hasGit || !hasUv || !hasAws)(
  'deploys to AWS successfully',

integ-tests/help.test.ts

@@ -6,7 +6,6 @@ const COMMANDS = [
  'deploy',
  'dev',
  'invoke',
- 'destroy',
  'status',
  'validate',
  'add',

src/cli/cli.ts

@@ -1,7 +1,6 @@
 import { registerAdd } from './commands/add';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
-import { registerDestroy } from './commands/destroy';
 import { registerDev } from './commands/dev';
 import { registerHelp } from './commands/help';
 import { registerInvoke } from './commands/invoke';
@@ -120,7 +119,6 @@ export function registerCommands(program: Command) {
  registerAdd(program);
  registerDev(program);
  registerDeploy(program);
- registerDestroy(program);
  registerCreate(program);
  registerHelp(program);
  registerInvoke(program);

src/cli/commands/deploy/__tests__/deploy-teardown.test.ts

@@ -0,0 +1,107 @@
+import { runCLI } from '../../../../test-utils/index.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('destroy command removed', () => {
+ it('destroy does not appear as a command in help output', async () => {
+ const result = await runCLI(['--help'], process.cwd());
+ expect(result.exitCode).toBe(0);
+ // Verify 'destroy' is not listed as a command
+ // Extract the commands section and check no line starts with destroy
+ const lines = result.stdout.split('\n').map(l => l.trim());
+ const commandLines = lines.filter(l => /^\w/.test(l));
+ expect(commandLines.some(l => l.startsWith('destroy'))).toBe(false);
+ });
+});
+
+describe('deploy with empty agents and deployed state (teardown)', () => {
+ let testDir: string;
+ let projectDir: string;
+
+ beforeAll(async () => {
+ testDir = join(tmpdir(), `agentcore-deploy-teardown-${randomUUID()}`);
+ await mkdir(testDir, { recursive: true });
+
+ // Create project without agents
+ const projectName = 'TeardownTestProj';
+ const result = await runCLI(['create', '--name', projectName, '--no-agent'], testDir);
+ if (result.exitCode !== 0) {
+ throw new Error(`Failed to create project: ${result.stdout} ${result.stderr}`);
+ }
+ projectDir = join(testDir, projectName);
+
+ // Add a target
+ const targetResult = await runCLI(
+ ['add', 'target', '--name', 'test-target', '--account', '123456789012', '--region', 'us-east-1', '--json'],
+ projectDir
+ );
+ if (targetResult.exitCode !== 0) {
+ throw new Error(`Failed to create target: ${targetResult.stdout} ${targetResult.stderr}`);
+ }
+ });
+
+ afterAll(async () => {
+ await rm(testDir, { recursive: true, force: true });
+ });
+
+ it('rejects deploy when no agents and no deployed state', async () => {
+ // With no agents and empty deployed-state, deploy should fail with "no agents" error
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ expect(result.exitCode).toBe(1);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('no agents');
+ });
+
+ it('requires --yes to confirm teardown deploy when deployed state exists', async () => {
+ // Simulate that a previous deploy happened by writing to deployed-state.json
+ // deployed-state.json lives in agentcore/.cli/
+ const cliDir = join(projectDir, 'agentcore', '.cli');
+ await mkdir(cliDir, { recursive: true });
+ const deployedStatePath = join(cliDir, 'deployed-state.json');
+ await writeFile(
+ deployedStatePath,
+ JSON.stringify({
+ targets: {
+ 'test-target': {
+ resources: {
+ stackName: 'TeardownTestProj-test-target',
+ agents: {
+ OldAgent: {
+ runtimeId: 'rt-123',
+ runtimeArn: 'arn:aws:agentcore:us-east-1:123456789012:runtime/rt-123',
+ roleArn: 'arn:aws:iam::123456789012:role/test-role',
+ },
+ },
+ },
+ },
+ },
+ })
+ );
+
+ // Without --yes, deploy should fail asking for confirmation
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('teardown');
+ expect(json.error).toContain('--yes');
+ }, 90000);
+
+ it('allows teardown deploy with --yes flag when deployed state exists', async () => {
+ // With --yes, deploy should proceed past the teardown confirmation
+ // It will eventually fail on AWS/CDK (no real credentials), but NOT on "no agents" or "teardown"
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json', '--yes'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(
+ !json.error?.toLowerCase().includes('no agents'),
+ `Should not fail with "no agents" when deployed state exists. Got: ${json.error}`
+ ).toBe(true);
+ expect(
+ !json.error?.toLowerCase().includes('teardown'),
+ `Should not fail with teardown confirmation when --yes is passed. Got: ${json.error}`
+ ).toBe(true);
+ }, 90000);
+});

src/cli/commands/deploy/actions.ts

@@ -1,4 +1,5 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
+import { validateAwsCredentials } from '../../aws/account';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import { buildDeployedState, getStackOutputs, parseAgentOutputs } from '../../cloudformation';
 import { getErrorMessage } from '../../errors';
@@ -10,6 +11,7 @@ import {
  checkStackDeployability,
  getAllCredentials,
  hasOwnedIdentityApiProviders,
+ performStackTeardown,
  setupApiKeyProviders,
  synthesizeCdk,
  validateProject,
@@ -67,6 +69,24 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
  const context = await validateProject();
  endStep('success');
 
+ // Teardown confirmation: if this is a teardown deploy, require --yes
+ if (context.isTeardownDeploy && !options.autoConfirm) {
+ logger.finalize(false);
+ return {
+ success: false,
+ error:
+ 'This will delete all deployed resources and the CloudFormation stack. Run with --yes to confirm teardown.',
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
+ // Validate AWS credentials (deferred for teardown deploys until after confirmation)
+ if (context.isTeardownDeploy) {
+ startStep('Validate AWS credentials');
+ await validateAwsCredentials();
+ endStep('success');
+ }
+
  // Ensure L3 constructs are linked (for local development)
  startStep('Link L3 constructs');
  await context.cdkProject.ensureL3Link();
@@ -195,6 +215,31 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
  endStep('success');
 
+ if (context.isTeardownDeploy) {
+ // After deploying the empty spec, destroy the stack entirely
+ startStep('Tear down stack');
+ const teardown = await performStackTeardown(target.name);
+ if (!teardown.success) {
+ endStep('error', teardown.error);
+ logger.finalize(false);
+ return {
+ success: false,
+ error: `Stack teardown failed: ${teardown.error}`,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+ endStep('success');
+
+ logger.finalize(true);
+
+ return {
+ success: true,
+ targetName: target.name,
+ stackName,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
  // Get stack outputs and persist state
  startStep('Persist deployment state');
  const outputs = await getStackOutputs(target.region, stackName);

README.md

@@ -85,7 +85,6 @@ agentcore invoke --stream
 | `validate` | Validate configuration files |
 | `deploy` | Deploy infrastructure to AWS |
 | `status` | Check deployment status |
-| `destroy` | Tear down deployed resources |
 
 ### Resource Management
 

docs/commands.md

@@ -65,21 +65,6 @@ agentcore deploy -v --json # Verbose JSON output
 | `-v, --verbose` | Resource-level events |
 | `--json` | JSON output |
 
-### destroy
-
-Tear down deployed resources.
-
-```bash
-agentcore destroy
-agentcore destroy --target dev -y # Auto-confirm
-```
-
-| Flag | Description |
-| ----------------- | ----------------- |
-| `--target <name>` | Target to destroy |
-| `-y, --yes` | Skip confirmation |
-| `--json` | JSON output |
-
 ### status
 
 Check deployment status.

integ-tests/deploy.test.ts

@@ -83,17 +83,17 @@ describe('integration: deploy', () => {
  }, 120000);
 
  afterAll(async () => {
- // Destroy resources and verify it succeeds
+ // Tear down deployed resources: remove all agents, then deploy --yes to destroy the stack
  if (projectPath && hasAws) {
- const result = await runCLI(['destroy', '--target', targetName, '--yes', '--json'], projectPath, false);
+ await runCLI(['remove', 'all', '--json'], projectPath, false);
+ const result = await runCLI(['deploy', '--target', targetName, '--yes', '--json'], projectPath, false);
 
- // Assert destroy succeeded
- expect(result.exitCode, `Destroy failed: ${result.stderr}`).toBe(0);
+ expect(result.exitCode, `Teardown failed: ${result.stderr}`).toBe(0);
  const json = JSON.parse(result.stdout);
- expect(json.success, 'Destroy should report success').toBe(true);
+ expect(json.success, 'Teardown should report success').toBe(true);
  }
  await rm(testDir, { recursive: true, force: true });
- }, 120000);
+ }, 300000);
 
  it.skipIf(!hasNpm || !hasGit || !hasUv || !hasAws)(
  'deploys to AWS successfully',

integ-tests/help.test.ts

@@ -6,7 +6,6 @@ const COMMANDS = [
  'deploy',
  'dev',
  'invoke',
- 'destroy',
  'status',
  'validate',
  'add',

src/cli/cli.ts

@@ -1,7 +1,6 @@
 import { registerAdd } from './commands/add';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
-import { registerDestroy } from './commands/destroy';
 import { registerDev } from './commands/dev';
 import { registerHelp } from './commands/help';
 import { registerInvoke } from './commands/invoke';
@@ -120,7 +119,6 @@ export function registerCommands(program: Command) {
  registerAdd(program);
  registerDev(program);
  registerDeploy(program);
- registerDestroy(program);
  registerCreate(program);
  registerHelp(program);
  registerInvoke(program);

src/cli/commands/deploy/__tests__/deploy-teardown.test.ts

@@ -0,0 +1,107 @@
+import { runCLI } from '../../../../test-utils/index.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('destroy command removed', () => {
+ it('destroy does not appear as a command in help output', async () => {
+ const result = await runCLI(['--help'], process.cwd());
+ expect(result.exitCode).toBe(0);
+ // Verify 'destroy' is not listed as a command
+ // Extract the commands section and check no line starts with destroy
+ const lines = result.stdout.split('\n').map(l => l.trim());
+ const commandLines = lines.filter(l => /^\w/.test(l));
+ expect(commandLines.some(l => l.startsWith('destroy'))).toBe(false);
+ });
+});
+
+describe('deploy with empty agents and deployed state (teardown)', () => {
+ let testDir: string;
+ let projectDir: string;
+
+ beforeAll(async () => {
+ testDir = join(tmpdir(), `agentcore-deploy-teardown-${randomUUID()}`);
+ await mkdir(testDir, { recursive: true });
+
+ // Create project without agents
+ const projectName = 'TeardownTestProj';
+ const result = await runCLI(['create', '--name', projectName, '--no-agent'], testDir);
+ if (result.exitCode !== 0) {
+ throw new Error(`Failed to create project: ${result.stdout} ${result.stderr}`);
+ }
+ projectDir = join(testDir, projectName);
+
+ // Add a target
+ const targetResult = await runCLI(
+ ['add', 'target', '--name', 'test-target', '--account', '123456789012', '--region', 'us-east-1', '--json'],
+ projectDir
+ );
+ if (targetResult.exitCode !== 0) {
+ throw new Error(`Failed to create target: ${targetResult.stdout} ${targetResult.stderr}`);
+ }
+ });
+
+ afterAll(async () => {
+ await rm(testDir, { recursive: true, force: true });
+ });
+
+ it('rejects deploy when no agents and no deployed state', async () => {
+ // With no agents and empty deployed-state, deploy should fail with "no agents" error
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ expect(result.exitCode).toBe(1);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('no agents');
+ });
+
+ it('requires --yes to confirm teardown deploy when deployed state exists', async () => {
+ // Simulate that a previous deploy happened by writing to deployed-state.json
+ // deployed-state.json lives in agentcore/.cli/
+ const cliDir = join(projectDir, 'agentcore', '.cli');
+ await mkdir(cliDir, { recursive: true });
+ const deployedStatePath = join(cliDir, 'deployed-state.json');
+ await writeFile(
+ deployedStatePath,
+ JSON.stringify({
+ targets: {
+ 'test-target': {
+ resources: {
+ stackName: 'TeardownTestProj-test-target',
+ agents: {
+ OldAgent: {
+ runtimeId: 'rt-123',
+ runtimeArn: 'arn:aws:agentcore:us-east-1:123456789012:runtime/rt-123',
+ roleArn: 'arn:aws:iam::123456789012:role/test-role',
+ },
+ },
+ },
+ },
+ },
+ })
+ );
+
+ // Without --yes, deploy should fail asking for confirmation
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('teardown');
+ expect(json.error).toContain('--yes');
+ }, 90000);
+
+ it('allows teardown deploy with --yes flag when deployed state exists', async () => {
+ // With --yes, deploy should proceed past the teardown confirmation
+ // It will eventually fail on AWS/CDK (no real credentials), but NOT on "no agents" or "teardown"
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json', '--yes'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(
+ !json.error?.toLowerCase().includes('no agents'),
+ `Should not fail with "no agents" when deployed state exists. Got: ${json.error}`
+ ).toBe(true);
+ expect(
+ !json.error?.toLowerCase().includes('teardown'),
+ `Should not fail with teardown confirmation when --yes is passed. Got: ${json.error}`
+ ).toBe(true);
+ }, 90000);
+});

src/cli/commands/deploy/actions.ts

@@ -1,4 +1,5 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
+import { validateAwsCredentials } from '../../aws/account';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import { buildDeployedState, getStackOutputs, parseAgentOutputs } from '../../cloudformation';
 import { getErrorMessage } from '../../errors';
@@ -10,6 +11,7 @@ import {
  checkStackDeployability,
  getAllCredentials,
  hasOwnedIdentityApiProviders,
+ performStackTeardown,
  setupApiKeyProviders,
  synthesizeCdk,
  validateProject,
@@ -67,6 +69,24 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
  const context = await validateProject();
  endStep('success');
 
+ // Teardown confirmation: if this is a teardown deploy, require --yes
+ if (context.isTeardownDeploy && !options.autoConfirm) {
+ logger.finalize(false);
+ return {
+ success: false,
+ error:
+ 'This will delete all deployed resources and the CloudFormation stack. Run with --yes to confirm teardown.',
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
+ // Validate AWS credentials (deferred for teardown deploys until after confirmation)
+ if (context.isTeardownDeploy) {
+ startStep('Validate AWS credentials');
+ await validateAwsCredentials();
+ endStep('success');
+ }
+
  // Ensure L3 constructs are linked (for local development)
  startStep('Link L3 constructs');
  await context.cdkProject.ensureL3Link();
@@ -195,6 +215,31 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
  endStep('success');
 
+ if (context.isTeardownDeploy) {
+ // After deploying the empty spec, destroy the stack entirely
+ startStep('Tear down stack');
+ const teardown = await performStackTeardown(target.name);
+ if (!teardown.success) {
+ endStep('error', teardown.error);
+ logger.finalize(false);
+ return {
+ success: false,
+ error: `Stack teardown failed: ${teardown.error}`,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+ endStep('success');
+
+ logger.finalize(true);
+
+ return {
+ success: true,
+ targetName: target.name,
+ stackName,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
  // Get stack outputs and persist state
  startStep('Persist deployment state');
  const outputs = await getStackOutputs(target.region, stackName);

README.md

@@ -85,7 +85,6 @@ agentcore invoke --stream
 | `validate` | Validate configuration files |
 | `deploy` | Deploy infrastructure to AWS |
 | `status` | Check deployment status |
-| `destroy` | Tear down deployed resources |
 
 ### Resource Management
 

docs/commands.md

@@ -65,21 +65,6 @@ agentcore deploy -v --json # Verbose JSON output
 | `-v, --verbose` | Resource-level events |
 | `--json` | JSON output |
 
-### destroy
-
-Tear down deployed resources.
-
-```bash
-agentcore destroy
-agentcore destroy --target dev -y # Auto-confirm
-```
-
-| Flag | Description |
-| ----------------- | ----------------- |
-| `--target <name>` | Target to destroy |
-| `-y, --yes` | Skip confirmation |
-| `--json` | JSON output |
-
 ### status
 
 Check deployment status.

integ-tests/deploy.test.ts

@@ -83,17 +83,17 @@ describe('integration: deploy', () => {
  }, 120000);
 
  afterAll(async () => {
- // Destroy resources and verify it succeeds
+ // Tear down deployed resources: remove all agents, then deploy --yes to destroy the stack
  if (projectPath && hasAws) {
- const result = await runCLI(['destroy', '--target', targetName, '--yes', '--json'], projectPath, false);
+ await runCLI(['remove', 'all', '--json'], projectPath, false);
+ const result = await runCLI(['deploy', '--target', targetName, '--yes', '--json'], projectPath, false);
 
- // Assert destroy succeeded
- expect(result.exitCode, `Destroy failed: ${result.stderr}`).toBe(0);
+ expect(result.exitCode, `Teardown failed: ${result.stderr}`).toBe(0);
  const json = JSON.parse(result.stdout);
- expect(json.success, 'Destroy should report success').toBe(true);
+ expect(json.success, 'Teardown should report success').toBe(true);
  }
  await rm(testDir, { recursive: true, force: true });
- }, 120000);
+ }, 300000);
 
  it.skipIf(!hasNpm || !hasGit || !hasUv || !hasAws)(
  'deploys to AWS successfully',

integ-tests/help.test.ts

@@ -6,7 +6,6 @@ const COMMANDS = [
  'deploy',
  'dev',
  'invoke',
- 'destroy',
  'status',
  'validate',
  'add',

src/cli/cli.ts

@@ -1,7 +1,6 @@
 import { registerAdd } from './commands/add';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
-import { registerDestroy } from './commands/destroy';
 import { registerDev } from './commands/dev';
 import { registerHelp } from './commands/help';
 import { registerInvoke } from './commands/invoke';
@@ -120,7 +119,6 @@ export function registerCommands(program: Command) {
  registerAdd(program);
  registerDev(program);
  registerDeploy(program);
- registerDestroy(program);
  registerCreate(program);
  registerHelp(program);
  registerInvoke(program);

src/cli/commands/deploy/__tests__/deploy-teardown.test.ts

@@ -0,0 +1,107 @@
+import { runCLI } from '../../../../test-utils/index.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('destroy command removed', () => {
+ it('destroy does not appear as a command in help output', async () => {
+ const result = await runCLI(['--help'], process.cwd());
+ expect(result.exitCode).toBe(0);
+ // Verify 'destroy' is not listed as a command
+ // Extract the commands section and check no line starts with destroy
+ const lines = result.stdout.split('\n').map(l => l.trim());
+ const commandLines = lines.filter(l => /^\w/.test(l));
+ expect(commandLines.some(l => l.startsWith('destroy'))).toBe(false);
+ });
+});
+
+describe('deploy with empty agents and deployed state (teardown)', () => {
+ let testDir: string;
+ let projectDir: string;
+
+ beforeAll(async () => {
+ testDir = join(tmpdir(), `agentcore-deploy-teardown-${randomUUID()}`);
+ await mkdir(testDir, { recursive: true });
+
+ // Create project without agents
+ const projectName = 'TeardownTestProj';
+ const result = await runCLI(['create', '--name', projectName, '--no-agent'], testDir);
+ if (result.exitCode !== 0) {
+ throw new Error(`Failed to create project: ${result.stdout} ${result.stderr}`);
+ }
+ projectDir = join(testDir, projectName);
+
+ // Add a target
+ const targetResult = await runCLI(
+ ['add', 'target', '--name', 'test-target', '--account', '123456789012', '--region', 'us-east-1', '--json'],
+ projectDir
+ );
+ if (targetResult.exitCode !== 0) {
+ throw new Error(`Failed to create target: ${targetResult.stdout} ${targetResult.stderr}`);
+ }
+ });
+
+ afterAll(async () => {
+ await rm(testDir, { recursive: true, force: true });
+ });
+
+ it('rejects deploy when no agents and no deployed state', async () => {
+ // With no agents and empty deployed-state, deploy should fail with "no agents" error
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ expect(result.exitCode).toBe(1);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('no agents');
+ });
+
+ it('requires --yes to confirm teardown deploy when deployed state exists', async () => {
+ // Simulate that a previous deploy happened by writing to deployed-state.json
+ // deployed-state.json lives in agentcore/.cli/
+ const cliDir = join(projectDir, 'agentcore', '.cli');
+ await mkdir(cliDir, { recursive: true });
+ const deployedStatePath = join(cliDir, 'deployed-state.json');
+ await writeFile(
+ deployedStatePath,
+ JSON.stringify({
+ targets: {
+ 'test-target': {
+ resources: {
+ stackName: 'TeardownTestProj-test-target',
+ agents: {
+ OldAgent: {
+ runtimeId: 'rt-123',
+ runtimeArn: 'arn:aws:agentcore:us-east-1:123456789012:runtime/rt-123',
+ roleArn: 'arn:aws:iam::123456789012:role/test-role',
+ },
+ },
+ },
+ },
+ },
+ })
+ );
+
+ // Without --yes, deploy should fail asking for confirmation
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('teardown');
+ expect(json.error).toContain('--yes');
+ }, 90000);
+
+ it('allows teardown deploy with --yes flag when deployed state exists', async () => {
+ // With --yes, deploy should proceed past the teardown confirmation
+ // It will eventually fail on AWS/CDK (no real credentials), but NOT on "no agents" or "teardown"
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json', '--yes'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(
+ !json.error?.toLowerCase().includes('no agents'),
+ `Should not fail with "no agents" when deployed state exists. Got: ${json.error}`
+ ).toBe(true);
+ expect(
+ !json.error?.toLowerCase().includes('teardown'),
+ `Should not fail with teardown confirmation when --yes is passed. Got: ${json.error}`
+ ).toBe(true);
+ }, 90000);
+});

src/cli/commands/deploy/actions.ts

@@ -1,4 +1,5 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
+import { validateAwsCredentials } from '../../aws/account';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import { buildDeployedState, getStackOutputs, parseAgentOutputs } from '../../cloudformation';
 import { getErrorMessage } from '../../errors';
@@ -10,6 +11,7 @@ import {
  checkStackDeployability,
  getAllCredentials,
  hasOwnedIdentityApiProviders,
+ performStackTeardown,
  setupApiKeyProviders,
  synthesizeCdk,
  validateProject,
@@ -67,6 +69,24 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
  const context = await validateProject();
  endStep('success');
 
+ // Teardown confirmation: if this is a teardown deploy, require --yes
+ if (context.isTeardownDeploy && !options.autoConfirm) {
+ logger.finalize(false);
+ return {
+ success: false,
+ error:
+ 'This will delete all deployed resources and the CloudFormation stack. Run with --yes to confirm teardown.',
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
+ // Validate AWS credentials (deferred for teardown deploys until after confirmation)
+ if (context.isTeardownDeploy) {
+ startStep('Validate AWS credentials');
+ await validateAwsCredentials();
+ endStep('success');
+ }
+
  // Ensure L3 constructs are linked (for local development)
  startStep('Link L3 constructs');
  await context.cdkProject.ensureL3Link();
@@ -195,6 +215,31 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
  endStep('success');
 
+ if (context.isTeardownDeploy) {
+ // After deploying the empty spec, destroy the stack entirely
+ startStep('Tear down stack');
+ const teardown = await performStackTeardown(target.name);
+ if (!teardown.success) {
+ endStep('error', teardown.error);
+ logger.finalize(false);
+ return {
+ success: false,
+ error: `Stack teardown failed: ${teardown.error}`,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+ endStep('success');
+
+ logger.finalize(true);
+
+ return {
+ success: true,
+ targetName: target.name,
+ stackName,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
  // Get stack outputs and persist state
  startStep('Persist deployment state');
  const outputs = await getStackOutputs(target.region, stackName);

README.md

@@ -85,7 +85,6 @@ agentcore invoke --stream
 | `validate` | Validate configuration files |
 | `deploy` | Deploy infrastructure to AWS |
 | `status` | Check deployment status |
-| `destroy` | Tear down deployed resources |
 
 ### Resource Management
 

docs/commands.md

@@ -65,21 +65,6 @@ agentcore deploy -v --json # Verbose JSON output
 | `-v, --verbose` | Resource-level events |
 | `--json` | JSON output |
 
-### destroy
-
-Tear down deployed resources.
-
-```bash
-agentcore destroy
-agentcore destroy --target dev -y # Auto-confirm
-```
-
-| Flag | Description |
-| ----------------- | ----------------- |
-| `--target <name>` | Target to destroy |
-| `-y, --yes` | Skip confirmation |
-| `--json` | JSON output |
-
 ### status
 
 Check deployment status.

integ-tests/deploy.test.ts

@@ -83,17 +83,17 @@ describe('integration: deploy', () => {
  }, 120000);
 
  afterAll(async () => {
- // Destroy resources and verify it succeeds
+ // Tear down deployed resources: remove all agents, then deploy --yes to destroy the stack
  if (projectPath && hasAws) {
- const result = await runCLI(['destroy', '--target', targetName, '--yes', '--json'], projectPath, false);
+ await runCLI(['remove', 'all', '--json'], projectPath, false);
+ const result = await runCLI(['deploy', '--target', targetName, '--yes', '--json'], projectPath, false);
 
- // Assert destroy succeeded
- expect(result.exitCode, `Destroy failed: ${result.stderr}`).toBe(0);
+ expect(result.exitCode, `Teardown failed: ${result.stderr}`).toBe(0);
  const json = JSON.parse(result.stdout);
- expect(json.success, 'Destroy should report success').toBe(true);
+ expect(json.success, 'Teardown should report success').toBe(true);
  }
  await rm(testDir, { recursive: true, force: true });
- }, 120000);
+ }, 300000);
 
  it.skipIf(!hasNpm || !hasGit || !hasUv || !hasAws)(
  'deploys to AWS successfully',

integ-tests/help.test.ts

@@ -6,7 +6,6 @@ const COMMANDS = [
  'deploy',
  'dev',
  'invoke',
- 'destroy',
  'status',
  'validate',
  'add',

src/cli/cli.ts

@@ -1,7 +1,6 @@
 import { registerAdd } from './commands/add';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
-import { registerDestroy } from './commands/destroy';
 import { registerDev } from './commands/dev';
 import { registerHelp } from './commands/help';
 import { registerInvoke } from './commands/invoke';
@@ -120,7 +119,6 @@ export function registerCommands(program: Command) {
  registerAdd(program);
  registerDev(program);
  registerDeploy(program);
- registerDestroy(program);
  registerCreate(program);
  registerHelp(program);
  registerInvoke(program);

src/cli/commands/deploy/__tests__/deploy-teardown.test.ts

@@ -0,0 +1,107 @@
+import { runCLI } from '../../../../test-utils/index.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('destroy command removed', () => {
+ it('destroy does not appear as a command in help output', async () => {
+ const result = await runCLI(['--help'], process.cwd());
+ expect(result.exitCode).toBe(0);
+ // Verify 'destroy' is not listed as a command
+ // Extract the commands section and check no line starts with destroy
+ const lines = result.stdout.split('\n').map(l => l.trim());
+ const commandLines = lines.filter(l => /^\w/.test(l));
+ expect(commandLines.some(l => l.startsWith('destroy'))).toBe(false);
+ });
+});
+
+describe('deploy with empty agents and deployed state (teardown)', () => {
+ let testDir: string;
+ let projectDir: string;
+
+ beforeAll(async () => {
+ testDir = join(tmpdir(), `agentcore-deploy-teardown-${randomUUID()}`);
+ await mkdir(testDir, { recursive: true });
+
+ // Create project without agents
+ const projectName = 'TeardownTestProj';
+ const result = await runCLI(['create', '--name', projectName, '--no-agent'], testDir);
+ if (result.exitCode !== 0) {
+ throw new Error(`Failed to create project: ${result.stdout} ${result.stderr}`);
+ }
+ projectDir = join(testDir, projectName);
+
+ // Add a target
+ const targetResult = await runCLI(
+ ['add', 'target', '--name', 'test-target', '--account', '123456789012', '--region', 'us-east-1', '--json'],
+ projectDir
+ );
+ if (targetResult.exitCode !== 0) {
+ throw new Error(`Failed to create target: ${targetResult.stdout} ${targetResult.stderr}`);
+ }
+ });
+
+ afterAll(async () => {
+ await rm(testDir, { recursive: true, force: true });
+ });
+
+ it('rejects deploy when no agents and no deployed state', async () => {
+ // With no agents and empty deployed-state, deploy should fail with "no agents" error
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ expect(result.exitCode).toBe(1);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('no agents');
+ });
+
+ it('requires --yes to confirm teardown deploy when deployed state exists', async () => {
+ // Simulate that a previous deploy happened by writing to deployed-state.json
+ // deployed-state.json lives in agentcore/.cli/
+ const cliDir = join(projectDir, 'agentcore', '.cli');
+ await mkdir(cliDir, { recursive: true });
+ const deployedStatePath = join(cliDir, 'deployed-state.json');
+ await writeFile(
+ deployedStatePath,
+ JSON.stringify({
+ targets: {
+ 'test-target': {
+ resources: {
+ stackName: 'TeardownTestProj-test-target',
+ agents: {
+ OldAgent: {
+ runtimeId: 'rt-123',
+ runtimeArn: 'arn:aws:agentcore:us-east-1:123456789012:runtime/rt-123',
+ roleArn: 'arn:aws:iam::123456789012:role/test-role',
+ },
+ },
+ },
+ },
+ },
+ })
+ );
+
+ // Without --yes, deploy should fail asking for confirmation
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('teardown');
+ expect(json.error).toContain('--yes');
+ }, 90000);
+
+ it('allows teardown deploy with --yes flag when deployed state exists', async () => {
+ // With --yes, deploy should proceed past the teardown confirmation
+ // It will eventually fail on AWS/CDK (no real credentials), but NOT on "no agents" or "teardown"
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json', '--yes'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(
+ !json.error?.toLowerCase().includes('no agents'),
+ `Should not fail with "no agents" when deployed state exists. Got: ${json.error}`
+ ).toBe(true);
+ expect(
+ !json.error?.toLowerCase().includes('teardown'),
+ `Should not fail with teardown confirmation when --yes is passed. Got: ${json.error}`
+ ).toBe(true);
+ }, 90000);
+});

src/cli/commands/deploy/actions.ts

@@ -1,4 +1,5 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
+import { validateAwsCredentials } from '../../aws/account';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import { buildDeployedState, getStackOutputs, parseAgentOutputs } from '../../cloudformation';
 import { getErrorMessage } from '../../errors';
@@ -10,6 +11,7 @@ import {
  checkStackDeployability,
  getAllCredentials,
  hasOwnedIdentityApiProviders,
+ performStackTeardown,
  setupApiKeyProviders,
  synthesizeCdk,
  validateProject,
@@ -67,6 +69,24 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
  const context = await validateProject();
  endStep('success');
 
+ // Teardown confirmation: if this is a teardown deploy, require --yes
+ if (context.isTeardownDeploy && !options.autoConfirm) {
+ logger.finalize(false);
+ return {
+ success: false,
+ error:
+ 'This will delete all deployed resources and the CloudFormation stack. Run with --yes to confirm teardown.',
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
+ // Validate AWS credentials (deferred for teardown deploys until after confirmation)
+ if (context.isTeardownDeploy) {
+ startStep('Validate AWS credentials');
+ await validateAwsCredentials();
+ endStep('success');
+ }
+
  // Ensure L3 constructs are linked (for local development)
  startStep('Link L3 constructs');
  await context.cdkProject.ensureL3Link();
@@ -195,6 +215,31 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
  endStep('success');
 
+ if (context.isTeardownDeploy) {
+ // After deploying the empty spec, destroy the stack entirely
+ startStep('Tear down stack');
+ const teardown = await performStackTeardown(target.name);
+ if (!teardown.success) {
+ endStep('error', teardown.error);
+ logger.finalize(false);
+ return {
+ success: false,
+ error: `Stack teardown failed: ${teardown.error}`,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+ endStep('success');
+
+ logger.finalize(true);
+
+ return {
+ success: true,
+ targetName: target.name,
+ stackName,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
  // Get stack outputs and persist state
  startStep('Persist deployment state');
  const outputs = await getStackOutputs(target.region, stackName);

README.md

@@ -85,7 +85,6 @@ agentcore invoke --stream
 | `validate` | Validate configuration files |
 | `deploy` | Deploy infrastructure to AWS |
 | `status` | Check deployment status |
-| `destroy` | Tear down deployed resources |
 
 ### Resource Management
 

docs/commands.md

@@ -65,21 +65,6 @@ agentcore deploy -v --json # Verbose JSON output
 | `-v, --verbose` | Resource-level events |
 | `--json` | JSON output |
 
-### destroy
-
-Tear down deployed resources.
-
-```bash
-agentcore destroy
-agentcore destroy --target dev -y # Auto-confirm
-```
-
-| Flag | Description |
-| ----------------- | ----------------- |
-| `--target <name>` | Target to destroy |
-| `-y, --yes` | Skip confirmation |
-| `--json` | JSON output |
-
 ### status
 
 Check deployment status.

integ-tests/deploy.test.ts

@@ -83,17 +83,17 @@ describe('integration: deploy', () => {
  }, 120000);
 
  afterAll(async () => {
- // Destroy resources and verify it succeeds
+ // Tear down deployed resources: remove all agents, then deploy --yes to destroy the stack
  if (projectPath && hasAws) {
- const result = await runCLI(['destroy', '--target', targetName, '--yes', '--json'], projectPath, false);
+ await runCLI(['remove', 'all', '--json'], projectPath, false);
+ const result = await runCLI(['deploy', '--target', targetName, '--yes', '--json'], projectPath, false);
 
- // Assert destroy succeeded
- expect(result.exitCode, `Destroy failed: ${result.stderr}`).toBe(0);
+ expect(result.exitCode, `Teardown failed: ${result.stderr}`).toBe(0);
  const json = JSON.parse(result.stdout);
- expect(json.success, 'Destroy should report success').toBe(true);
+ expect(json.success, 'Teardown should report success').toBe(true);
  }
  await rm(testDir, { recursive: true, force: true });
- }, 120000);
+ }, 300000);
 
  it.skipIf(!hasNpm || !hasGit || !hasUv || !hasAws)(
  'deploys to AWS successfully',

integ-tests/help.test.ts

@@ -6,7 +6,6 @@ const COMMANDS = [
  'deploy',
  'dev',
  'invoke',
- 'destroy',
  'status',
  'validate',
  'add',

src/cli/cli.ts

@@ -1,7 +1,6 @@
 import { registerAdd } from './commands/add';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
-import { registerDestroy } from './commands/destroy';
 import { registerDev } from './commands/dev';
 import { registerHelp } from './commands/help';
 import { registerInvoke } from './commands/invoke';
@@ -120,7 +119,6 @@ export function registerCommands(program: Command) {
  registerAdd(program);
  registerDev(program);
  registerDeploy(program);
- registerDestroy(program);
  registerCreate(program);
  registerHelp(program);
  registerInvoke(program);

src/cli/commands/deploy/__tests__/deploy-teardown.test.ts

@@ -0,0 +1,107 @@
+import { runCLI } from '../../../../test-utils/index.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('destroy command removed', () => {
+ it('destroy does not appear as a command in help output', async () => {
+ const result = await runCLI(['--help'], process.cwd());
+ expect(result.exitCode).toBe(0);
+ // Verify 'destroy' is not listed as a command
+ // Extract the commands section and check no line starts with destroy
+ const lines = result.stdout.split('\n').map(l => l.trim());
+ const commandLines = lines.filter(l => /^\w/.test(l));
+ expect(commandLines.some(l => l.startsWith('destroy'))).toBe(false);
+ });
+});
+
+describe('deploy with empty agents and deployed state (teardown)', () => {
+ let testDir: string;
+ let projectDir: string;
+
+ beforeAll(async () => {
+ testDir = join(tmpdir(), `agentcore-deploy-teardown-${randomUUID()}`);
+ await mkdir(testDir, { recursive: true });
+
+ // Create project without agents
+ const projectName = 'TeardownTestProj';
+ const result = await runCLI(['create', '--name', projectName, '--no-agent'], testDir);
+ if (result.exitCode !== 0) {
+ throw new Error(`Failed to create project: ${result.stdout} ${result.stderr}`);
+ }
+ projectDir = join(testDir, projectName);
+
+ // Add a target
+ const targetResult = await runCLI(
+ ['add', 'target', '--name', 'test-target', '--account', '123456789012', '--region', 'us-east-1', '--json'],
+ projectDir
+ );
+ if (targetResult.exitCode !== 0) {
+ throw new Error(`Failed to create target: ${targetResult.stdout} ${targetResult.stderr}`);
+ }
+ });
+
+ afterAll(async () => {
+ await rm(testDir, { recursive: true, force: true });
+ });
+
+ it('rejects deploy when no agents and no deployed state', async () => {
+ // With no agents and empty deployed-state, deploy should fail with "no agents" error
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ expect(result.exitCode).toBe(1);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('no agents');
+ });
+
+ it('requires --yes to confirm teardown deploy when deployed state exists', async () => {
+ // Simulate that a previous deploy happened by writing to deployed-state.json
+ // deployed-state.json lives in agentcore/.cli/
+ const cliDir = join(projectDir, 'agentcore', '.cli');
+ await mkdir(cliDir, { recursive: true });
+ const deployedStatePath = join(cliDir, 'deployed-state.json');
+ await writeFile(
+ deployedStatePath,
+ JSON.stringify({
+ targets: {
+ 'test-target': {
+ resources: {
+ stackName: 'TeardownTestProj-test-target',
+ agents: {
+ OldAgent: {
+ runtimeId: 'rt-123',
+ runtimeArn: 'arn:aws:agentcore:us-east-1:123456789012:runtime/rt-123',
+ roleArn: 'arn:aws:iam::123456789012:role/test-role',
+ },
+ },
+ },
+ },
+ },
+ })
+ );
+
+ // Without --yes, deploy should fail asking for confirmation
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(json.success).toBe(false);
+ expect(json.error.toLowerCase()).toContain('teardown');
+ expect(json.error).toContain('--yes');
+ }, 90000);
+
+ it('allows teardown deploy with --yes flag when deployed state exists', async () => {
+ // With --yes, deploy should proceed past the teardown confirmation
+ // It will eventually fail on AWS/CDK (no real credentials), but NOT on "no agents" or "teardown"
+ const result = await runCLI(['deploy', '--target', 'test-target', '--json', '--yes'], projectDir);
+ const json = JSON.parse(result.stdout);
+ expect(
+ !json.error?.toLowerCase().includes('no agents'),
+ `Should not fail with "no agents" when deployed state exists. Got: ${json.error}`
+ ).toBe(true);
+ expect(
+ !json.error?.toLowerCase().includes('teardown'),
+ `Should not fail with teardown confirmation when --yes is passed. Got: ${json.error}`
+ ).toBe(true);
+ }, 90000);
+});

src/cli/commands/deploy/actions.ts

@@ -1,4 +1,5 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
+import { validateAwsCredentials } from '../../aws/account';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import { buildDeployedState, getStackOutputs, parseAgentOutputs } from '../../cloudformation';
 import { getErrorMessage } from '../../errors';
@@ -10,6 +11,7 @@ import {
  checkStackDeployability,
  getAllCredentials,
  hasOwnedIdentityApiProviders,
+ performStackTeardown,
  setupApiKeyProviders,
  synthesizeCdk,
  validateProject,
@@ -67,6 +69,24 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
  const context = await validateProject();
  endStep('success');
 
+ // Teardown confirmation: if this is a teardown deploy, require --yes
+ if (context.isTeardownDeploy && !options.autoConfirm) {
+ logger.finalize(false);
+ return {
+ success: false,
+ error:
+ 'This will delete all deployed resources and the CloudFormation stack. Run with --yes to confirm teardown.',
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
+ // Validate AWS credentials (deferred for teardown deploys until after confirmation)
+ if (context.isTeardownDeploy) {
+ startStep('Validate AWS credentials');
+ await validateAwsCredentials();
+ endStep('success');
+ }
+
  // Ensure L3 constructs are linked (for local development)
  startStep('Link L3 constructs');
  await context.cdkProject.ensureL3Link();
@@ -195,6 +215,31 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
  endStep('success');
 
+ if (context.isTeardownDeploy) {
+ // After deploying the empty spec, destroy the stack entirely
+ startStep('Tear down stack');
+ const teardown = await performStackTeardown(target.name);
+ if (!teardown.success) {
+ endStep('error', teardown.error);
+ logger.finalize(false);
+ return {
+ success: false,
+ error: `Stack teardown failed: ${teardown.error}`,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+ endStep('success');
+
+ logger.finalize(true);
+
+ return {
+ success: true,
+ targetName: target.name,
+ stackName,
+ logPath: logger.getRelativeLogPath(),
+ };
+ }
+
  // Get stack outputs and persist state
  startStep('Persist deployment state');
  const outputs = await getStackOutputs(target.region, stackName);