fix(cursor-agent): inject --approve-mcps --force for headless MCP/tool access

The previous commit (1c55988) wired up ``-p --trust`` so the CLI launches
in headless mode without the Workspace Trust prompt, but that alone is
not enough to let ``specify workflow run`` drive a real speckit feature
end-to-end with cursor-agent on Windows. Two more flags are required:

* ``--approve-mcps``: without it, every MCP server configured in
  ``.cursor/mcp.json`` stays ``not loaded (needs approval)``, and any
  tool call against them is silently dropped. We hit this immediately
  trying to read a DingTalk PRD from a remote MCP server during the
  ``/speckit-specify`` step.
* ``--force``: without it, the agent halts on the first tool-call
  approval prompt (the tool call gets rejected and the workflow exits
  non-zero with a misleading message). With ``--force`` cursor-agent
  matches the implicit "trusted environment" semantics that ``claude -p``
  and ``codex --exec`` already have by default -- which is the right
  semantics for an unattended ``specify workflow run`` invocation.

Verified end-to-end on Windows 10 + cursor-agent 2026.05.16-0338208:

* ``cursor-agent -p --trust --approve-mcps --force --output-format text``
  + a ``/speckit-specify`` prompt that included a DingTalk URL produced
  a full spec.md (31.5 KB) plus checklists/requirements.md in ~10.7 min,
  reading the source PRD through the ``dingtalk-doc`` remote MCP server,
  deciding the ``specs/`` subpath itself, and updating
  ``.specify/feature.json`` and ``specs/menu-dictionary.md`` along the
  way -- no human-in-the-loop, no source PRD ever touched the filesystem.
* Without ``--approve-mcps`` the same prompt errors with the tool call
  rejected message; without ``--force`` the agent stops at the first
  non-MCP tool call.

Tests:

* ``test_build_exec_args_*`` updated to pin the new four-flag prefix.
* New ``test_build_exec_args_contains_mandatory_headless_flags`` asserts
  the four flags are always present together.
* ``test_dispatch_command_resolves_cmd_shim_for_subprocess`` updated to
  match the new argv layout.
* All 43 cursor-agent tests pass; no other tests touched.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 刘一

src/specify_cli/integrations/cursor_agent/__init__.py

@@ -41,14 +41,30 @@ def build_exec_args(
     ) -> list[str] | None:
         """Build CLI arguments for non-interactive ``cursor-agent`` execution.
 
-        Uses ``-p`` (print/headless mode, which gives access to all
-        tools including write and shell) plus ``--trust`` (bypass the
-        Workspace Trust prompt — mandatory for headless execution; the
-        CLI exits non-zero without it).
+        Mandatory headless flags:
+
+        * ``-p`` — print/headless mode (access to all tools)
+        * ``--trust`` — bypass Workspace Trust prompt (CLI exits non-zero
+          otherwise)
+        * ``--approve-mcps`` — auto-approve MCP server loading (otherwise
+          MCP servers stay ``not loaded (needs approval)`` and tool calls
+          to them are silently dropped)
+        * ``--force`` — auto-approve tool invocations (shell/write/MCP),
+          matching the implicit "trusted environment" semantics that other
+          integrations (``claude -p``, ``codex --exec``) get by default
+
+        Together these are the minimum set required to make
+        ``specify workflow run speckit --input integration=cursor-agent``
+        behave the same way as it does for ``claude`` / ``codex``.
+        Verified locally: with ``--approve-mcps --force`` the agent can
+        call any configured MCP server (e.g. ``dingtalk-doc``) and write
+        files during ``/speckit-*`` skill execution; without them the run
+        either drops tool calls or exits non-zero on the first approval
+        prompt.
         """
         if not self.config or not self.config.get("requires_cli"):
             return None
-        args = [self.key, "-p", "--trust", prompt]
+        args = [self.key, "-p", "--trust", "--approve-mcps", "--force", prompt]
         if model:
             args.extend(["--model", model])
         if output_json:

tests/integrations/test_integration_cursor_agent.py

@@ -126,11 +126,14 @@ def test_install_url_is_set(self):
         assert url is not None
         assert "cursor.com" in url
 
-    def test_build_exec_args_default_includes_trust_and_json(self):
+    def test_build_exec_args_default_includes_headless_flags_and_json(self):
+        """Default argv emits the full headless flag set: -p --trust
+        --approve-mcps --force, then prompt, then --output-format json.
+        """
         i = get_integration("cursor-agent")
         args = i.build_exec_args("/speckit-specify some-feature")
         assert args == [
-            "cursor-agent", "-p", "--trust",
+            "cursor-agent", "-p", "--trust", "--approve-mcps", "--force",
             "/speckit-specify some-feature",
             "--output-format", "json",
         ]
@@ -139,7 +142,8 @@ def test_build_exec_args_text_output_omits_format(self):
         i = get_integration("cursor-agent")
         args = i.build_exec_args("/speckit-plan", output_json=False)
         assert args == [
-            "cursor-agent", "-p", "--trust", "/speckit-plan",
+            "cursor-agent", "-p", "--trust", "--approve-mcps", "--force",
+            "/speckit-plan",
         ]
 
     def test_build_exec_args_with_model(self):
@@ -148,10 +152,26 @@ def test_build_exec_args_with_model(self):
             "/speckit-specify", model="sonnet-4-thinking", output_json=False
         )
         assert args == [
-            "cursor-agent", "-p", "--trust", "/speckit-specify",
+            "cursor-agent", "-p", "--trust", "--approve-mcps", "--force",
+            "/speckit-specify",
             "--model", "sonnet-4-thinking",
         ]
 
+    def test_build_exec_args_contains_mandatory_headless_flags(self):
+        """The four headless flags must always appear together.
+
+        ``--approve-mcps`` is required so MCP servers (e.g. dingtalk-doc)
+        actually load in headless mode; ``--force`` is required so the
+        agent doesn't block on tool-call approval prompts during the
+        speckit workflow.  Together with ``-p`` and ``--trust`` they
+        bring cursor-agent's headless behaviour in line with
+        ``claude -p`` / ``codex --exec`` from spec-kit's perspective.
+        """
+        i = get_integration("cursor-agent")
+        args = i.build_exec_args("/speckit-implement", output_json=False)
+        for flag in ("-p", "--trust", "--approve-mcps", "--force"):
+            assert flag in args, f"missing mandatory headless flag: {flag}"
+
     def test_build_command_invocation_uses_hyphenated_skill_name(self):
         """SkillsIntegration: /speckit-plan (not /speckit.plan)."""
         i = get_integration("cursor-agent")
@@ -189,7 +209,7 @@ def test_dispatch_command_resolves_cmd_shim_for_subprocess(self):
         assert result["exit_code"] == 0
         argv = mock_run.call_args[0][0]
         assert argv[0] == fake_path, f"expected resolved .CMD path, got: {argv[0]!r}"
-        assert argv[1:4] == ["-p", "--trust", "/speckit-plan feature-x"]
+        assert argv[1:6] == ["-p", "--trust", "--approve-mcps", "--force", "/speckit-plan feature-x"]
 
     def test_dispatch_command_passthrough_when_shutil_which_finds_nothing(self):
         """If ``shutil.which`` returns ``None``, leave argv unchanged so the