fix(mobile): route create_session ids through the SDK runtime shim

[iscekic]

Problem

/new in a remote CLI session on mobile fails with "Property crypto does not exist".

Hermes has no global crypto binding. createSession in @kilocode/cloud-agent-sdk called crypto.randomUUID() directly, so the call threw before the command reached the CLI.

Fix

The package already owns a runtime shim (packages/cloud-agent-sdk/src/runtime.ts) for exactly this. The mobile app configures it with expo-crypto in apps/mobile/src/lib/cloud-agent-runtime.ts.

cli-live-transport.ts:879 and :899 were the only two call sites in the package that bypassed the shim. Both now use cloudAgentSdkRuntime.randomUUID().

Test

New case in cli-live-transport.test.ts configures the runtime and asserts the create_session mutationId comes from it. Verified the test fails on the old code and passes on the new code.

Checks

• pnpm test (cloud-agent-sdk): 107 passed
• pnpm typecheck (cloud-agent-sdk): clean
• pnpm lint: 0 warnings, 0 errors

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the Hermes crypto.randomUUID() fix with high confidence: both create_session mutationId call sites now route through the existing cloudAgentSdkRuntime shim (matching the mobile app's expo-crypto configuration), no other bare crypto call sites remain in the package, and the new regression test correctly asserts the mutationId argument (index 4 of sendCommand) with proper global-state cleanup in finally. No new listeners, timers, or subscriptions are introduced, so no memory-leak concerns.

Files Reviewed (2 files)

• packages/cloud-agent-sdk/src/cli-live-transport.ts
• packages/cloud-agent-sdk/src/cli-live-transport.test.ts

---

_{Reviewed by kimi-k3 · Input: 42.2K · Output: 7.5K · Cached: 446.1K}

_{Review guidance: REVIEW.md from base branch main}