Isolinear ▦

A keyboard-driven terminal UI for managing Databricks secrets. Browse scopes, secrets and ACLs; create / edit / delete; reveal & copy values — all from a fast, calm three-pane TUI.

Read the docs → — installation, connecting, the full keyboard reference, themes, and the security model.

Install

Run it with uv — no clone, no virtualenv:

uvx isolinear              # run once, ephemerally
uv tool install isolinear  # install the `isolinear` (and `iso`) commands on PATH

Or with pipx: pipx run isolinear / pipx install isolinear.

Requires Python ≥ 3.11. Built with Textual and the Databricks SDK.

Quickstart

isolinear        # or: iso

You don't need to pre-configure anything. Isolinear opens a workspace picker that gathers connection targets from three places — each row labelled with its Source, so you always know where it came from:

1. Asset bundle — if a databricks.yml (Databricks Asset Bundle) sits in the current directory, its target workspace is offered as the default, pre-selected so you connect with a single keystroke.
2. ~/.databrickscfg — every saved profile is listed automatically.
3. Workspace URL — Add by URL and sign in through your browser (OAuth U2M / SSO). No token required; tick save as profile to keep it.

Pick a row and press Enter. Saved profiles connect instantly; a bundle target or a URL opens the browser to sign in — exactly like databricks auth login (host + auth_type = external-browser, no secret ever stored).

Workspace picker — bundle + profiles + URL	Authorization overview

Features

• Workspace picker — connect from a Databricks Asset Bundle (databricks.yml, offered as the default), your ~/.databrickscfg profiles, or a workspace URL — each row labelled with its source.
• Three-pane browser — scopes (with secret counts + your access), secrets (with relative age), and a detail pane.
• Reveal & copy secret values; values are fetched lazily on reveal and never bulk-pulled into memory.
• Full CRUD — create / edit / delete secrets, create / delete scopes, manage scope permissions (ACLs).
• Authorization overview — your effective permission on every scope.
• Fuzzy filter (/), command palette (ctrl+p), vim + arrow navigation.
• Pre-loads & caches everything on startup for an instant experience.
• A calm Graphite default theme, plus optional violet / amber / phosphor skins.

Keys

Everything is keyboard driven. Press ? for the in-app cheat-sheet or ctrl+p for the fuzzy command palette.

The command palette (ctrl+p) holds the rest: bulk .env import/export, a who-has-access principal lookup, and forget revealed values.

Run isolinear prod (or --profile prod) to connect straight to a discovered workspace, and add --read-only to browse and reveal with every mutation disabled — handy when you're just poking around production. Preferences (theme, scope toggle, audit threshold) persist in ~/.config/isolinear/settings.json.

Security

Isolinear talks to Databricks through the official SDK's unified auth. It does not store secret values — they're read on demand and kept only in memory. Saved profiles contain a host + auth_type, never a token. See SECURITY.md for details and how to report a vulnerability.

How it's built

Hexagonal / DDD layers; dependencies point inward and all I/O is behind domain ports, so the UI never touches the SDK and the whole domain is unit-testable without a network:

isolinear/
  domain/          model, rules + ports (SecretStore, WorkspaceConnector, ProfileStore, BundleStore)
  application/     use-cases (WorkspaceService, OnboardingService) + read model
  infrastructure/  adapters — the only Databricks-SDK importers
  interface/       Textual presentation (no business logic, no infra)
  app.py           composition root

Contributing

Issues and PRs welcome — see CONTRIBUTING.md. The toolkit is all-Astral: uv (env/deps/run), ruff (lint+format), ty (types).

uv sync
uv run pytest        # tests (core units + UI via Textual Pilot)
uv run ruff check .  # lint
uv run ty check      # types
uv run isolinear     # run it

uv run --group docs mkdocs serve   # preview the docs site at localhost:8000

License

MIT © Misja Pronk