Discrepancy in project name normalization with encoded spaces (%20)

[danilakari]

📋 Pre-flight Checks

• I have searched existing issues and this is not a duplicate
• I understand this issue needs status:approved before a PR can be opened

📝 Bug Description

When sync is run for a project name containing a URL encoded space (e.g. "%20"), the client URL-encodes it in the query parameters as project=%2520. The server decodes this to "%20". During authorization, NormalizeProject leaves it as "%20". However, NormalizeProjectGrant applies normalizeCloudProjectGrant which replaces non-alphanumeric characters. It normalizes "%20" to "-20" (replacing % with - and keeping the alphanumeric 20 and together without an extra hyphen). If the project was registered manually as "-" or "-20-", the comparison fails and access is denied.

🔄 Steps to Reproduce

1. Create a local project with a space in the directory name: .
2. Run the sync command: engram sync --cloud --project "%20".
3. Server receives "%20" and normalizes it to "-20" during the grant lookup.
4. The database grant - or -20- does not match, causing 403 Forbidden.

✅ Expected Behavior

Project names with spaces (or URL-encoded spaces) should be normalized consistently between local project enrollment, database grants, and runtime checks.

❌ Actual Behavior

Discrepancy in replacement of %20 leads to mismatched strings (-20 vs -20- or -), blocking access with 403 Forbidden.

Operating System

Linux (Ubuntu/Debian)

Engram Version

1.20.0

Agent / Client

OpenCode

📋 Relevant Logs

💡 Additional Context

As a workaround, adding an explicit grant for the exact normalized variant (e.g. -20) allows the sync to proceed.