fix(#378): validate local service access in cron jobs

Health monitor cron jobs that reference localhost/Ollama fail when
running on cloud models (nous/mimo-v2-pro) that can't reach
localhost:11434.

Changes:
- Add _validate_local_service_access() to detect local service refs
- Inject warning into prompt when mismatch detected
- Add ModelContextError and CRON_MIN_CONTEXT_TOKENS (missing defs)
- Add _check_model_context_compat stub for test imports
- Add tests for validation logic

Refs #378

cron/scheduler.py

@@ -13,6 +13,7 @@ import concurrent.futures
 import json
 import logging
 import os
+import re
 import subprocess
 import sys
 
@@ -40,6 +41,44 @@ from hermes_time import now as _hermes_now
 
 logger = logging.getLogger(__name__)
 
+# Minimum context tokens for cron jobs — models with smaller context are rejected
+# to prevent truncation of long prompts + tool outputs.
+CRON_MIN_CONTEXT_TOKENS = 64_000
+
+
+class ModelContextError(ValueError):
+    """Raised when a model's context length is too small for cron execution."""
+    pass
+
+
+def _check_model_context_compat(model: str, base_url: str = None, config_context_length: int = None):
+    """Check if a model's context length meets the minimum for cron jobs.
+    
+    Raises ModelContextError if the model's context is too small.
+    Silently passes if detection fails (fail-open).
+    """
+    if config_context_length is not None and config_context_length < CRON_MIN_CONTEXT_TOKENS:
+        raise ModelContextError(
+            f"Model '{model}' has {config_context_length:,} context tokens, "
+            f"but cron jobs require at least {CRON_MIN_CONTEXT_TOKENS:,}. "
+            f"Set a larger model in config.yaml or override per-job."
+        )
+    
+    try:
+        from agent.model_metadata import get_model_context_length
+        context_length = get_model_context_length(model, base_url=base_url)
+        if context_length is not None and context_length < CRON_MIN_CONTEXT_TOKENS:
+            raise ModelContextError(
+                f"Model '{model}' has {context_length:,} context tokens, "
+                f"but cron jobs require at least {CRON_MIN_CONTEXT_TOKENS:,}. "
+                f"Set a larger model in config.yaml or override per-job."
+            )
+    except ModelContextError:
+        raise
+    except Exception:
+        # Detection failure is non-fatal — fail open
+        logger.debug("Context length detection failed for %s, skipping check", model)
+
 
 # =====================================================================
 # Deploy Sync Guard
@@ -642,6 +681,73 @@ def _build_job_prompt(job: dict) -> str:
     return "\n".join(parts)
 
 
+def _validate_local_service_access(job: dict, prompt: str) -> tuple[bool, str]:
+    """
+    Validate that a cron job can access local services it references.
+    
+    Detects prompts that reference localhost services (Ollama, etc.) and
+    ensures the job is configured with a local base_url or provider.
+    
+    Returns:
+        (is_valid, warning_message) — True if no issue, False if mismatch detected.
+    """
+    # Patterns that indicate local service access is required
+    local_service_patterns = [
+        r"localhost:\d+",
+        r"127\.0\.0\.1:\d+",
+        r"Check Ollama",
+        r"check.*ollama",
+        r"Ollama.*responding",
+        r"ollama.*responding",
+        r"local.*model.*health",
+        r"health.*local.*model",
+        r"ping.*localhost",
+        r"curl.*localhost",
+    ]
+    
+    # Check if prompt references local services
+    prompt_lower = prompt.lower()
+    references_local = any(
+        re.search(pattern, prompt_lower) for pattern in local_service_patterns
+    )
+    
+    if not references_local:
+        return True, ""
+    
+    # Check if job is configured for local access
+    base_url = job.get("base_url", "")
+    provider = job.get("provider", "")
+    model = job.get("model", "")
+    
+    # Check for explicit local base_url
+    if base_url and ("localhost" in base_url or "127.0.0.1" in base_url):
+        return True, ""
+    
+    # Check for Ollama provider
+    if provider and "ollama" in provider.lower():
+        return True, ""
+    
+    # Check for common local model patterns in model name
+    local_model_patterns = ["ollama", "llama", "mistral", "phi", "qwen", "gemma", "codellama"]
+    if model and any(pattern in model.lower() for pattern in local_model_patterns):
+        # Model name suggests local, but verify base_url
+        if not base_url:
+            return False, (
+                f"Cron job '{job.get('name', job.get('id'))}' references local services "
+                f"(localhost/Ollama) but has no base_url configured. "
+                f"Set base_url='http://localhost:11434' for Ollama, or pin to a local provider."
+            )
+        return True, ""
+    
+    # No local configuration detected
+    return False, (
+        f"Cron job '{job.get('name', job.get('id'))}' references local services "
+        f"(localhost/Ollama) but is configured for cloud model "
+        f"(model={model or 'default'}, provider={provider or 'default'}). "
+        f"To check local Ollama, set base_url='http://localhost:11434' or provider='ollama'."
+    )
+
+
 def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
     """
     Execute a single cron job.
@@ -667,6 +773,18 @@ def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
     job_id = job["id"]
     job_name = job["name"]
     prompt = _build_job_prompt(job)
+    
+    # Validate local service access — detect prompts referencing localhost/Ollama
+    # that will fail on cloud models (#378)
+    is_valid, warning = _validate_local_service_access(job, prompt)
+    if not is_valid:
+        logger.warning("Job '%s': %s", job_name, warning)
+        # Inject warning into prompt so agent knows to report the issue
+        prompt = (
+            f"[SYSTEM WARNING: {warning}]\n\n"
+            f"{prompt}"
+        )
+    
     origin = _resolve_origin(job)
     _cron_session_id = f"cron_{job_id}_{_hermes_now().strftime('%Y%m%d_%H%M%S')}"
 

tests/cron/test_scheduler.py

@@ -7,7 +7,7 @@ from unittest.mock import AsyncMock, patch, MagicMock
 
 import pytest
 
-from cron.scheduler import _resolve_origin, _resolve_delivery_target, _deliver_result, run_job, SILENT_MARKER, _build_job_prompt, _check_model_context_compat, ModelContextError, CRON_MIN_CONTEXT_TOKENS
+from cron.scheduler import _resolve_origin, _resolve_delivery_target, _deliver_result, run_job, SILENT_MARKER, _build_job_prompt, _check_model_context_compat, ModelContextError, CRON_MIN_CONTEXT_TOKENS, _validate_local_service_access
 
 
 class TestResolveOrigin:
@@ -1001,3 +1001,99 @@ class TestCheckModelContextCompat:
         ):
             with pytest.raises(ModelContextError):
                 _check_model_context_compat("borderline-model")
+
+
+class TestValidateLocalServiceAccess:
+    """Tests for _validate_local_service_access — detects local service mismatches (#378)."""
+    
+    def test_no_local_reference_passes(self):
+        """Prompt without local references always passes."""
+        job = {"name": "test", "model": "gpt-4"}
+        is_valid, msg = _validate_local_service_access(job, "Check system health")
+        assert is_valid is True
+        assert msg == ""
+    
+    def test_localhost_reference_with_local_base_url(self):
+        """Prompt references localhost but job has local base_url — passes."""
+        job = {
+            "name": "health-check",
+            "model": "llama3",
+            "base_url": "http://localhost:11434/v1",
+        }
+        is_valid, msg = _validate_local_service_access(job, "Check if Ollama is responding on localhost:11434")
+        assert is_valid is True
+        assert msg == ""
+    
+    def test_localhost_reference_with_cloud_model_fails(self):
+        """Prompt references localhost but job uses cloud model — fails."""
+        job = {
+            "name": "health-check",
+            "model": "nous/mimo-v2-pro",
+            "provider": "nous",
+        }
+        is_valid, msg = _validate_local_service_access(job, "Check Ollama is responding on localhost:11434")
+        assert is_valid is False
+        assert "localhost" in msg.lower() or "ollama" in msg.lower()
+        assert "cloud model" in msg.lower() or "base_url" in msg.lower()
+    
+    def test_ollama_check_with_ollama_provider(self):
+        """Prompt references Ollama and job uses ollama provider — passes."""
+        job = {
+            "name": "ollama-health",
+            "provider": "ollama",
+            "base_url": "http://localhost:11434",
+        }
+        is_valid, msg = _validate_local_service_access(job, "Check Ollama is responding")
+        assert is_valid is True
+        assert msg == ""
+    
+    def test_case_insensitive_detection(self):
+        """Detection is case-insensitive."""
+        job = {"name": "test", "model": "gpt-4"}
+        # Lowercase
+        is_valid, _ = _validate_local_service_access(job, "check ollama is responding")
+        assert is_valid is False
+        # Uppercase
+        is_valid, _ = _validate_local_service_access(job, "CHECK OLLAMA IS RESPONDING")
+        assert is_valid is False
+        # Mixed case
+        is_valid, _ = _validate_local_service_access(job, "Check if Ollama Is Responding")
+        assert is_valid is False
+    
+    def test_curl_localhost_detected(self):
+        """curl localhost references are detected."""
+        job = {"name": "test", "model": "gpt-4"}
+        is_valid, _ = _validate_local_service_access(job, "Run curl localhost:8080/health")
+        assert is_valid is False
+    
+    def test_127_0_0_1_detected(self):
+        """127.0.0.1 references are detected."""
+        job = {"name": "test", "model": "gpt-4"}
+        is_valid, _ = _validate_local_service_access(job, "Check http://127.0.0.1:11434/api/tags")
+        assert is_valid is False
+    
+    def test_local_model_name_without_base_url_fails(self):
+        """Model name suggests local but no base_url — fails."""
+        job = {"name": "test", "model": "llama3"}
+        is_valid, msg = _validate_local_service_access(job, "Check Ollama is responding")
+        assert is_valid is False
+        assert "base_url" in msg
+    
+    def test_local_model_name_with_base_url_passes(self):
+        """Model name suggests local and has base_url — passes."""
+        job = {"name": "test", "model": "llama3", "base_url": "http://localhost:11434"}
+        is_valid, msg = _validate_local_service_access(job, "Check Ollama is responding")
+        assert is_valid is True
+        assert msg == ""
+    
+    def test_nightwatch_health_monitor_scenario(self):
+        """Reproduces the exact #378 scenario."""
+        job = {
+            "name": "nightwatch-health-monitor",
+            "model": "nous/mimo-v2-pro",
+            "provider": "nous",
+        }
+        prompt = "Check Ollama is responding. Run curl http://localhost:11434/api/tags and report status."
+        is_valid, msg = _validate_local_service_access(job, prompt)
+        assert is_valid is False
+        assert "nightwatch-health-monitor" in msg or "localhost" in msg