"Cloaking" in this situation would be fine. When the user agent contains bot|crawl|slurp|spider
you should not use session id parameters or check for cookies. You are delivering the same content to users and bots. Google won't have a problem with this particular cloak.
I use a similar technique for deciding whether or not to use Data URI for the images on my site. I treat all bots the same as IE 7 and earlier which cannot handle Data URIs. Technically it is cloaking, but all bots get the same data and would render the same pixels on the screen as users. They just get that data through different technical means.
It might also be worth exploring different ways of handling the issue. If it were my site I might set cookies, and then use JavaScript like this on the links: onclick="if(!document.cookie.indexOf('session')this.href+='?session=abcdef1234';"
Googlebot doesn't execute the onclick when following links, so it would still be able to crawl your site without parameters.
When you are using session parameters, you should log into Google Search Console and tell Google to ignore them. Open the URL Parameters Tool or view the crawl parameters documenation. You will want to add your session parameter and set it to "Doesn't effect page content (ex. tracks usage)".