feat(cli): add destroy command for tearing down deployed agents

packages/cli/README.md

@@ -13,6 +13,7 @@ agentworkforce show <persona>[@<tier>]
 agentworkforce install [flags] <pkg|path>
 agentworkforce sources <list|add|remove>
 agentworkforce harness check
+agentworkforce destroy <persona-or-agent-id> [--workspace <id>] [--cloud-url <url>] [--no-prompt]
 agentworkforce --version
 ```
 
@@ -29,6 +30,11 @@ agentworkforce --version
 - `sources` — list, add, or remove persona source directories.
 - `harness check` — probe which harnesses (`claude`, `codex`, `opencode`)
   are installed. See [`## Harness check`](#harness-check) below.
+- `destroy` — tear down a deployed cloud agent: cancels all relaycron
+  schedules and marks the agent as destroyed. Accepts either a persona
+  JSON path (slug resolved via the workspace's agents index) or a literal
+  agent UUID. Exits `0` on success, `2` when the agent is unknown or
+  already destroyed, `1` for any other failure.
 - `--version` — print the installed package version.
 
 ## Install

packages/cli/src/cli.ts

@@ -59,6 +59,7 @@ import {
 } from '@relayfile/local-mount';
 import ora, { type Ora } from 'ora';
 import { runDeploy, runLogin } from './deploy-command.js';
+import { runDestroy } from './destroy-command.js';
 import {
   startLaunchMetadataRecording,
   type LaunchMetadataRun
@@ -202,6 +203,19 @@ Commands:
                         --cloud-url <url>   override the workforce cloud URL
                         --input KEY=value   override a declared persona input
                                             (repeat for multiple)
+  destroy <persona-or-agent-id> [flags]
+                      Tear down a deployed agent: cancel all schedules and
+                      mark the agent as destroyed in the workspace. Accepts
+                      either a persona JSON path (resolved to an agent id
+                      via the workspace's agents index) or a literal agent
+                      UUID.
+                      Flags:
+                        --workspace <id>    pick a non-default workspace
+                        --cloud-url <url>   override the workforce cloud URL
+                        --no-prompt         fail instead of opening the
+                                            browser login flow
+                      Exit codes: 0 destroyed, 2 not found / already
+                      destroyed, 1 any other error.
   login               Connect this machine to a workforce workspace. The
                       browser-based flow is rolling out; until then it prints
                       the WORKFORCE_WORKSPACE_ID / WORKFORCE_WORKSPACE_TOKEN
@@ -234,6 +248,8 @@ Examples:
   agentworkforce agent "$(agentworkforce pick "fix the flaky test in foo.test.ts")"
   agentworkforce deploy ./personas/weekly-digest.json --mode cloud
   agentworkforce deploy ./personas/weekly-digest.json --mode sandbox --input TOPIC="Deploy v1"
+  agentworkforce destroy ./personas/weekly-digest.json
+  agentworkforce destroy 11111111-2222-4333-8444-555555555555
   agentworkforce login
 `;
 
@@ -3773,6 +3789,11 @@ export async function main(): Promise<void> {
     return;
   }
 
+  if (subcommand === 'destroy') {
+    await runDestroy(rest);
+    return;
+  }
+
   if (subcommand === 'login') {
     await runLogin(rest);
     return;