feat(worker): user-scoped box terminal token verification

apps/agent-worker/src/terminal-token.ts

@@ -27,3 +27,28 @@ export const verifyTerminalToken = (
     timingSafeEqual(providedBuf, expectedBuf)
   );
 };
+
+// User-scoped variant authorizing a terminal connection to a user's box.
+// Embeds a literal `box` segment so its four parts never collide with the
+// three-part job token above. Format:
+//   `${expiresAtMs}.box.${username}.${hmacSha256Hex}`
+export const verifyBoxTerminalToken = (
+  token: string,
+  username: string,
+  secret: string,
+): boolean => {
+  if (!token || !secret) return false;
+  const parts = token.split('.');
+  if (parts.length !== 4 || parts[1] !== 'box') return false;
+  const [expRaw, , tokenUsername, provided] = parts;
+  if (tokenUsername !== username) return false;
+  const exp = Number.parseInt(expRaw ?? '', 10);
+  if (!Number.isFinite(exp) || Date.now() > exp) return false;
+  const expected = signature(`${expRaw}.box.${tokenUsername}`, secret);
+  const providedBuf = Buffer.from(provided ?? '', 'hex');
+  const expectedBuf = Buffer.from(expected, 'hex');
+  return (
+    providedBuf.length === expectedBuf.length &&
+    timingSafeEqual(providedBuf, expectedBuf)
+  );
+};