Checkpoint paths with glob characters prune and list the wrong directory

JsonProvider.prune() and crewai checkpoint list treat glob characters in the checkpoint location or branch as a pattern. For branch run[1], prune deletes the checkpoints of run1 and keeps run[1].

Difficulty

Easy

Time

~5 min

Steps

Fixed in

—

Last checked

Oct 20, 2026

Unverified: we could not confirm from the sources that a fix shipped. Source: PR #8269 merged. Last checked 2026-10-20.

Symptom

Evidence what you'll see

The report's snippet prints requested exists: True for branch run[1] and neighbor exists: False for branch run1 after provider.prune(directory, max_keep=0, branch="run[1]").
crewai checkpoint list, info, and prune read the wrong directory the same way.
prune() also runs automatically after each checkpoint when CheckpointConfig.max_checkpoints is set.

Why it happens

The checkpoint location and branch are passed to glob.glob() without escaping. Pull request 8269 uses glob.escape() on the directory part in JsonProvider.prune() and in the five JSON patterns of crewai_cli/checkpoint_cli.py.

Affected versions

crewAI 1.15.28, main at 40bb2d3, macOS 26.3, Python 3.13. crewAI Tools is not used.

Fix steps

0 of 2 done

Step 1fixed on main in PR #8269, not yet released.
Step 2The linked issue does not give a released package version that treats those paths as literals. Until a tag contains that pull request, avoid glob characters such as [ in the checkpoint location or branch.

Your check marks stay in this browser only.

How to check it worked

After provider.prune(directory, max_keep=0, branch="run[1]"), the run[1] checkpoint is gone and the run1 checkpoint remains.

If it still fails

No published release tag contains pull request 8269. Tag 1.15.28 was compared against merge 4f4573706e and does not contain it.
Paths without glob characters keep matching *.json and **/*.json. The pull request says that is intended.

Sources and credit

Summarized in our own words from these public reports. Credit goes to their authors.

Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change

Hit an error we don't cover? Submit it