docs: A run's work directory only resolves against a visible data link at the bucket root

platform-cloud/cloud-sidebar.json

@@ -312,6 +312,7 @@
           "troubleshooting_and_faqs/workspaces_troubleshooting",
           "troubleshooting_and_faqs/resource-labels",
           "troubleshooting_and_faqs/datasets_troubleshooting",
+          "troubleshooting_and_faqs/data_explorer_troubleshooting",
           "troubleshooting_and_faqs/sso_troubleshooting",
           "troubleshooting_and_faqs/seqera-ai"
         ]

platform-cloud/docs/data/data-explorer.md

@@ -2,7 +2,7 @@
 title: "Data Explorer"
 description: "Using Seqera Data Explorer."
 date created: "2023-04-21"
-last updated: "2026-08-20"
+last updated: "2026-08-28"
 tags: [data, explorer, igv, molstar, object, storage, lineage]
 ---
 
@@ -49,6 +49,10 @@ Data Explorer lists public and private data repositories. Repositories accessibl
 
   Select **Add data repository** from the Data Explorer tab to add a link to an individual repository (or prefix within a cloud bucket). Specify the **Provider**, **Path**, **Name**, **Credentials**, and **Description**, then select **Add**. For public cloud buckets, select **Public** from the **Credentials** drop-down.
 
+:::note
+Add a data-link at the root of any bucket or container used as a pipeline work directory, such as `s3://my-bucket`. Seqera Platform matches a run's work directory only against bucket-root data-links. A data-link scoped to a prefix such as `s3://my-bucket/work` does not open the work directory in Data Explorer. See [Isolate view, read, and write permissions to specific data repository paths](#isolate-view-read-and-write-permissions-to-specific-data-repository-paths).
+:::
+
 ## Remove data repository links
 
 A workspace maintainer can remove a manually created data-link to a repository.
@@ -152,6 +156,16 @@ To isolate pipeline or Studios view, read, and write permissions to a specific *
 This customized Data Explorer view displays by default for all workspace users until a workspace maintainer updates or removes the filter.
 :::
 
+Custom data-links scoped to a prefix do not resolve run work directories. Seqera Platform matches a run's work directory to a data-link whose path is the root of the bucket or container, such as `s3://my-bucket` rather than `s3://my-bucket/work`. It strips the path below the root before matching, searches visible data-links only, and reapplies the path once a data-link matches.
+
+You can still browse a data-link registered at `s3://my-bucket/work`, but it never matches a run whose work directory is `s3://my-bucket/work/a1/b2c3d4`. A hidden bucket-root data-link has the same effect as no bucket-root data-link.
+
+To keep the work directory view, add a visible data-link at the root of each bucket or container used as a pipeline work directory. Your existing prefix-scoped data-links continue to work unchanged. For the symptoms and resolution, see [Work directory cannot be viewed in Data Explorer](../troubleshooting_and_faqs/data_explorer_troubleshooting#work-directory-cannot-be-viewed-in-data-explorer).
+
+:::warning
+A visible bucket-root data-link lets every workspace member, including participants with the View role, browse and download the whole bucket. This removes the path isolation that your prefix-scoped data-links provide. Hiding the bucket-root data-link does not narrow this access, because hidden data-links remain reachable. The credentials attached to a data-link define what Data Explorer reaches through it. See [Access control](#access-control).
+:::
+
 ## Upload files to private data repositories
 
 Data Explorer supports single or bulk file uploads to your private data repositories. From the **View data repositories** page, select **Upload** and choose either the **Upload files** or **Upload folder** option. You can also drag and drop files and folders directly into Data Explorer. You can upload up to 300 files at a time via the Platform interface. The file size upload limits reflect the size limitations of the relevant cloud storage provider or data repository integration.
@@ -312,6 +326,8 @@ Using remote data repositories as inputs for pipelines or Studios requires the s
 Multi-credential support for compute environments and Fusion is under active development and will resolve this limitation.
 :::
 
+A run's work directory opens in Data Explorer only when the workspace has a visible data-link at the root of the bucket or container that holds the work directory. Data-links scoped to a prefix below the root do not resolve work directories. See [Isolate view, read, and write permissions to specific data repository paths](#isolate-view-read-and-write-permissions-to-specific-data-repository-paths).
+
 {/* links */}
 [roles]: ../orgs-and-teams/roles
 [molstar]: https://molstar.org/

platform-cloud/docs/monitoring/run-details.mdx

@@ -2,7 +2,7 @@
 title: "Run details"
 description: "Monitoring a Nextflow pipeline executed through Seqera Platform."
 date created: "2023-04-21"
-last updated: "2026-04-29"
+last updated: "2026-08-28"
 tags: [logging, monitoring, runs, details, workflows, execution, lineage]
 ---
 
@@ -180,6 +180,8 @@ Real-time log streaming is available only for compute environments that stream l
 
 If the pipeline work directory is in cloud storage, this tab shows a [Data Explorer](../data/data-explorer) view of the task's work directory location with the files associated with the task.
 
+This view requires a visible data-link at the root of the bucket or container that holds the work directory. If the workspace has only data-links scoped to a prefix below the root, this tab reports that the work directory cannot be viewed. See [Work directory cannot be viewed in Data Explorer](../troubleshooting_and_faqs/data_explorer_troubleshooting#work-directory-cannot-be-viewed-in-data-explorer).
+
 #### Container
 
 This tab contains the image and build details of the container used to execute the task:
@@ -390,7 +392,7 @@ The **Infrastructure details** view displays compute environment and work direct
 
 - **Compute environment** name. Select **Preview** to view a window with basic compute environment details, or **View** to navigate to the compute environment page.
 - **(Provider) operation ID**. The unique identifier for the task submitted to the cloud provider or compute platform, such as an AWS Batch operation ID.
-- **Work directory**. Select **View** to browse the work directory in Data Explorer.
+- **Work directory**. Select **View** to browse the work directory in Data Explorer. **View** is disabled when the work directory is not in cloud storage, or when the workspace has no visible [bucket-root data-link](../data/data-explorer#isolate-view-read-and-write-permissions-to-specific-data-repository-paths) for it.
 - **Compute environment ID**.
 
 #### Executor(s) details

platform-cloud/docs/troubleshooting_and_faqs/data_explorer_troubleshooting.md

@@ -0,0 +1,29 @@
+---
+title: "Data Explorer"
+description: "Data Explorer troubleshooting with Seqera Platform."
+date created: "2026-08-28"
+last updated: "2026-08-28"
+tags: [faq, help, data explorer, troubleshooting]
+---
+
+When working with Data Explorer, you might encounter the following issues.
+
+## Work directories
+
+### Work directory cannot be viewed in Data Explorer
+
+The **Data Explorer** tab of the **Task details** dialog reports the following:
+
+```
+This work directory can't be viewed in Data Explorer.
+```
+
+The **View** button beside **Work directory** on the **Run Info** tab is disabled.
+
+This issue occurs when the workspace has no visible data-link at the root of the bucket or container that holds the work directory. Seqera Platform matches a run's work directory against bucket-root data-links only. A data-link registered at a prefix such as `s3://my-bucket/work` never matches, and a hidden bucket-root data-link is excluded from the match.
+
+To resolve, add a data-link at the bucket or container root, such as `s3://my-bucket`, and leave it visible. Your existing prefix-scoped data-links continue to work unchanged.
+
+A visible bucket-root data-link lets every workspace member browse and download the whole bucket. See [Isolate view, read, and write permissions to specific data repository paths](../data/data-explorer#isolate-view-read-and-write-permissions-to-specific-data-repository-paths).
+
+If the work directory is not in cloud storage, such as a path on a high-performance computing (HPC) or local filesystem, Data Explorer cannot display it.

platform-enterprise_docs/data/data-explorer.md

@@ -2,7 +2,7 @@
 title: "Data Explorer"
 description: "Using Seqera Data Explorer."
 date created: "2025-05-08"
-last updated: "2026-08-20"
+last updated: "2026-08-28"
 tags: [data, explorer]
 ---
 
@@ -57,6 +57,10 @@ Data Explorer lists public and private data repositories. Repositories accessibl
 
   Select **Add data repository** from the Data Explorer tab to add a link to an individual repository (or prefix within a cloud bucket). Specify the **Provider**, **Path**, **Name**, **Credentials**, and **Description**, then select **Add**. For public cloud buckets, select **Public** from the **Credentials** drop-down.
 
+:::note
+Add a data-link at the root of any bucket or container used as a pipeline work directory, such as `s3://my-bucket`. Seqera Platform matches a run's work directory only against bucket-root data-links. A data-link scoped to a prefix such as `s3://my-bucket/work` does not open the work directory in Data Explorer. See [Isolate view, read, and write permissions to specific data repository paths](#isolate-view-read-and-write-permissions-to-specific-data-repository-paths).
+:::
+
 ## Browse data repositories
 
 ![](./_images/data_explorer.png)
@@ -128,6 +132,16 @@ To isolate pipeline or Studios view, read, and write permissions to a specific *
 This customized Data Explorer view displays by default for all workspace users until a workspace maintainer updates or removes the filter.
 :::
 
+Custom data-links scoped to a prefix do not resolve run work directories. Seqera Platform matches a run's work directory to a data-link whose path is the root of the bucket or container, such as `s3://my-bucket` rather than `s3://my-bucket/work`. It strips the path below the root before matching, searches visible data-links only, and reapplies the path once a data-link matches.
+
+You can still browse a data-link registered at `s3://my-bucket/work`, but it never matches a run whose work directory is `s3://my-bucket/work/a1/b2c3d4`. A hidden bucket-root data-link has the same effect as no bucket-root data-link.
+
+To keep the work directory view, add a visible data-link at the root of each bucket or container used as a pipeline work directory. Your existing prefix-scoped data-links continue to work unchanged. For the symptoms and resolution, see [Work directory cannot be viewed in Data Explorer](../troubleshooting_and_faqs/data_explorer_troubleshooting#work-directory-cannot-be-viewed-in-data-explorer).
+
+:::warning
+A visible bucket-root data-link lets every workspace member, including participants with the View role, browse and download the whole bucket. This removes the path isolation that your prefix-scoped data-links provide. Hiding the bucket-root data-link does not narrow this access, because hidden data-links remain reachable. The credentials attached to a data-link define what Data Explorer reaches through it. See [Access control](#access-control).
+:::
+
 ## Upload files to private data repositories
 
 Data Explorer supports single or bulk file uploads to your private data repositories. From the **View data repositories** page, select **Upload** and choose either the **Upload files** or **Upload folder** option. You can also drag and drop files and folders directly into Data Explorer. You can upload up to 300 files at a time via the Platform interface. The file size upload limits reflect the size limitations of the relevant cloud storage provider or data repository integration.

platform-enterprise_docs/enterprise-sidebar.json

@@ -456,7 +456,8 @@
         "troubleshooting_and_faqs/aws_troubleshooting",
         "troubleshooting_and_faqs/azure_troubleshooting",
         "troubleshooting_and_faqs/workspaces_troubleshooting",
-        "troubleshooting_and_faqs/datasets_troubleshooting"
+        "troubleshooting_and_faqs/datasets_troubleshooting",
+        "troubleshooting_and_faqs/data_explorer_troubleshooting"
       ]
     }
   ]

platform-enterprise_docs/monitoring/run-details.mdx

@@ -2,7 +2,7 @@
 title: "Run details"
 description: "Monitoring a Nextflow pipeline executed through Seqera Platform."
 date created: "2023-04-21"
-last updated: "2026-05-11"
+last updated: "2026-08-28"
 tags: [logging, monitoring, runs, details, workflows, execution, lineage]
 ---
 
@@ -179,6 +179,8 @@ Real-time log streaming is available only for compute environments that stream l
 
 If the pipeline work directory is in cloud storage, this tab shows a [Data Explorer](../data/data-explorer) view of the task's work directory location with the files associated with the task.
 
+This view requires a visible data-link at the root of the bucket or container that holds the work directory. If the workspace has only data-links scoped to a prefix below the root, this tab reports that the work directory cannot be viewed. See [Work directory cannot be viewed in Data Explorer](../troubleshooting_and_faqs/data_explorer_troubleshooting#work-directory-cannot-be-viewed-in-data-explorer).
+
 #### Container
 
 This tab contains the image and build details of the container used to execute the task:
@@ -389,7 +391,7 @@ The **Infrastructure details** view displays compute environment and work direct
 
 - **Compute environment** name. Select **Preview** to view a window with basic compute environment details, or **View** to navigate to the compute environment page.
 - **(Provider) operation ID**. The unique identifier for the task submitted to the cloud provider or compute platform, such as an AWS Batch operation ID.
-- **Work directory**. Select **View** to browse the work directory in Data Explorer.
+- **Work directory**. Select **View** to browse the work directory in Data Explorer. **View** is disabled when the work directory is not in cloud storage, or when the workspace has no visible [bucket-root data-link](../data/data-explorer#isolate-view-read-and-write-permissions-to-specific-data-repository-paths) for it.
 - **Compute environment ID**.
 
 #### Executor(s) details

platform-enterprise_docs/troubleshooting_and_faqs/data_explorer_troubleshooting.md

@@ -0,0 +1,29 @@
+---
+title: "Data Explorer"
+description: "Data Explorer troubleshooting with Seqera Platform."
+date created: "2026-08-28"
+last updated: "2026-08-28"
+tags: [faq, help, data explorer, troubleshooting]
+---
+
+When working with Data Explorer, you might encounter the following issues.
+
+## Work directories
+
+### Work directory cannot be viewed in Data Explorer
+
+The **Data Explorer** tab of the **Task details** dialog reports the following:
+
+```
+This work directory can't be viewed in Data Explorer.
+```
+
+The **View** button beside **Work directory** on the **Run Info** tab is disabled.
+
+This issue occurs when the workspace has no visible data-link at the root of the bucket or container that holds the work directory. Seqera Platform matches a run's work directory against bucket-root data-links only. A data-link registered at a prefix such as `s3://my-bucket/work` never matches, and a hidden bucket-root data-link is excluded from the match.
+
+To resolve, add a data-link at the bucket or container root, such as `s3://my-bucket`, and leave it visible. Your existing prefix-scoped data-links continue to work unchanged.
+
+A visible bucket-root data-link lets every workspace member browse and download the whole bucket. See [Isolate view, read, and write permissions to specific data repository paths](../data/data-explorer#isolate-view-read-and-write-permissions-to-specific-data-repository-paths).
+
+If the work directory is not in cloud storage, such as a path on a high-performance computing (HPC) or local filesystem, Data Explorer cannot display it.

platform-enterprise_versioned_docs/version-26.1/data/data-explorer.md

@@ -2,7 +2,7 @@
 title: "Data Explorer"
 description: "Using Seqera Data Explorer."
 date created: "2023-04-21"
-last updated: "2026-07-31"
+last updated: "2026-08-28"
 tags: [data, explorer, igv, molstar, object, storage, lineage]
 ---
 
@@ -36,6 +36,10 @@ Data Explorer lists public and private data repositories. Repositories accessibl
 
   Select **Add data repository** from the Data Explorer tab to add a link to an individual repository (or prefix within a cloud bucket). Specify the **Provider**, **Path**, **Name**, **Credentials**, and **Description**, then select **Add**. For public cloud buckets, select **Public** from the **Credentials** drop-down.
 
+:::note
+Add a data-link at the root of any bucket or container used as a pipeline work directory, such as `s3://my-bucket`. Seqera Platform matches a run's work directory only against bucket-root data-links. A data-link scoped to a prefix such as `s3://my-bucket/work` does not open the work directory in Data Explorer. See [Isolate view, read, and write permissions to specific data repository paths](#isolate-view-read-and-write-permissions-to-specific-data-repository-paths).
+:::
+
 ## Remove data repository links
 
 A workspace maintainer can remove a manually created data-link to a repository.
@@ -139,6 +143,16 @@ To isolate pipeline or Studios view, read, and write permissions to a specific *
 This customized Data Explorer view will be displayed by default to all workspace users, until the filter is updated or removed by a workspace maintainer.
 :::
 
+Custom data-links scoped to a prefix do not resolve run work directories. Seqera Platform matches a run's work directory to a data-link whose path is the root of the bucket or container, such as `s3://my-bucket` rather than `s3://my-bucket/work`. It strips the path below the root before matching, searches visible data-links only, and reapplies the path once a data-link matches.
+
+You can still browse a data-link registered at `s3://my-bucket/work`, but it never matches a run whose work directory is `s3://my-bucket/work/a1/b2c3d4`. A hidden bucket-root data-link has the same effect as no bucket-root data-link.
+
+To keep the work directory view, add a visible data-link at the root of each bucket or container used as a pipeline work directory. Your existing prefix-scoped data-links continue to work unchanged. For the symptoms and resolution, see [Work directory cannot be viewed in Data Explorer](../troubleshooting_and_faqs/data_explorer_troubleshooting#work-directory-cannot-be-viewed-in-data-explorer).
+
+:::warning
+A visible bucket-root data-link lets every workspace member, including participants with the View role, browse and download the whole bucket. This removes the path isolation that your prefix-scoped data-links provide. Hiding the bucket-root data-link does not narrow this access, because hidden data-links remain reachable. The credentials you select when you add a data-link define the scope of what Data Explorer reaches through it.
+:::
+
 ## Upload files to private data repositories
 
 Data Explorer supports single or bulk file uploads to your private data repositories. From the **View data repositories** page, select **Upload** and choose either the **Upload files** or **Upload folder** option. You can also drag and drop files and folders directly into Data Explorer. You can upload up to 300 files at a time via the Platform interface. The file size upload limits reflect the size limitations of the relevant cloud storage provider or data repository integration.
@@ -300,6 +314,8 @@ Using remote data repositories as inputs for pipelines or Studios currently requ
 Compute environment and Fusion multi-credential support will resolve this existing limitation, and is under active development.
 :::
 
+A run's work directory opens in Data Explorer only when the workspace has a visible data-link at the root of the bucket or container that holds the work directory. Data-links scoped to a prefix below the root do not resolve work directories. See [Isolate view, read, and write permissions to specific data repository paths](#isolate-view-read-and-write-permissions-to-specific-data-repository-paths).
+
 {/* links */}
 [roles]: ../orgs-and-teams/roles
 [molstar]: https://molstar.org/