fix: randombytes must be a real (non-inline) C-linkage definition — tweetnacl.o links against it and an inline C++ definition may never be emitted, leaving the plugin with an undefined symbol that kills the first agent_card call; no exceptions across the C boundary

Author: retraca

scaffold/src/agent_module_impl.cpp

@@ -20,6 +20,16 @@
 #include "agent_module_impl.h"
 #include "card_signing.h"
 
+// TweetNaCl's entropy source (declared in card_signing.h). No exceptions across the
+// C boundary: on a read failure we abort key generation by zero-filling, and the
+// signing self-check (verify before publish) keeps a bad key from ever shipping.
+extern "C" void randombytes(unsigned char* buf, unsigned long long n) {
+    std::ifstream ur("/dev/urandom", std::ios::binary);
+    if (!ur.read(reinterpret_cast<char*>(buf), static_cast<std::streamsize>(n))) {
+        for (unsigned long long i = 0; i < n; ++i) buf[i] = 0;
+    }
+}
+
 // Generated SDK header providing modules(), bind_lez_wallet(), etc.
 // Included from sdk_generated/ at build time (logos-cpp-generator --general-only).
 #include "logos_sdk.h"

scaffold/src/card_signing.h

@@ -17,12 +17,12 @@ extern "C" {
 #include "tweetnacl.h"
 }
 
-// TweetNaCl requires the embedder to provide randombytes().
-extern "C" inline void randombytes(unsigned char* buf, unsigned long long n) {
-    std::ifstream ur("/dev/urandom", std::ios::binary);
-    if (!ur.read(reinterpret_cast<char*>(buf), static_cast<std::streamsize>(n)))
-        throw std::runtime_error("randombytes: /dev/urandom read failed");
-}
+// TweetNaCl requires the embedder to provide randombytes(). Declared here with C
+// linkage; DEFINED (non-inline) in agent_module_impl.cpp so the C object file
+// tweetnacl.o resolves the symbol at link time — an inline definition is not
+// guaranteed to be emitted and leaves the .so with an undefined symbol that only
+// explodes on the first agent_card call.
+extern "C" void randombytes(unsigned char* buf, unsigned long long n);
 
 namespace cardsig {