Fix cross-workspace auth for M2M app-to-app flow

[calreynolds]

Summary

• Fixes two bugs that prevented the M2M cross-workspace flow from working:

  1. FMAPI (Claude API) was pointed at the target workspace instead of the Builder App's workspace where the model serving endpoint lives
  2. get_workspace_client() ignored the target workspace token — always used the Builder App's own SP env credentials, even when explicit cross-workspace credentials were set via set_databricks_auth()

• Adds a force_token flag to set_databricks_auth() that makes get_workspace_client() use the explicit token instead of env OAuth. Only set when cross-workspace params are provided — normal Builder App behavior is unchanged.

• Splits FMAPI and tools auth: FMAPI always stays on the Builder App's workspace, tools target the caller-specified workspace.

Changes

File	Change
databricks-tools-core/.../auth.py	force_token context var + kwarg on set_databricks_auth(). get_workspace_client() checks it first.
databricks-builder-app/.../routers/agent.py	target_databricks_host/target_databricks_token on request model. Split FMAPI vs tools creds.
databricks-builder-app/.../services/agent.py	fmapi_host/fmapi_token/is_cross_workspace params. FMAPI env uses fmapi_*, tools use databricks_* with force_token.

Test plan

• Deploy Builder App on workspace A, verify normal (single-workspace) behavior is unchanged
• Deploy client app on workspace B with SP credentials for workspace C (e2-demo-field-eng)
• Send a request through the client app and verify resources are created on workspace C, not workspace A
• Verify Claude API calls (FMAPI) still route through workspace A's model serving endpoint

Made with Cursor