ltcai 10.7.0 → 10.9.0

package/latticeai/api/auth.py

@@ -9,10 +9,11 @@ from dataclasses import dataclass
 from typing import Any, Awaitable, Callable, Dict, Optional
 from urllib.parse import urlencode
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Request
 from fastapi.responses import JSONResponse, RedirectResponse
 from pydantic import BaseModel
 
+from latticeai.core.messages import DEFAULT_LANGUAGE, http_error, resolve_language
 from latticeai.core.oidc import (
     OIDCValidationError,
 )
@@ -92,18 +93,16 @@ def create_auth_router(
 ) -> APIRouter:
     router = APIRouter()
 
-    def _enforce_password_policy(password: str) -> None:
+    def _enforce_password_policy(password: str, language: str = DEFAULT_LANGUAGE) -> None:
         # Real policy (v4): length >= 8 with letters AND digits. A 4-char
         # minimum was not a policy.
         pw = str(password or "")
         if len(pw) < 8 or not any(c.isalpha() for c in pw) or not any(c.isdigit() for c in pw):
-            raise HTTPException(
-                status_code=400,
-                detail="비밀번호는 8자 이상이며 영문자와 숫자를 모두 포함해야 합니다.",
-            )
+            raise http_error(400, "auth.password_too_weak", language)
 
     @router.post("/register")
     async def register(req: UserRegister, request: Request):
+        lang = resolve_language(request)
         check_ip_rate_limit(client_ip(request), "register", max_calls=5, window_secs=3600)
         invite_claim = bool(
             invite_gate_enabled
@@ -111,19 +110,16 @@ def create_auth_router(
             and invite_authorized(request)
         )
         if invite_gate_enabled and not invite_claim:
-            raise HTTPException(
-                status_code=403,
-                detail="유효한 서명 초대 권한이 필요합니다.",
-            )
+            raise http_error(403, "auth.invitation_required", lang)
         # Closed public registration stays closed unless the operator enabled
         # the invite gate and this exact request carries a valid signed claim.
         if not open_registration and not invite_claim:
-            raise HTTPException(status_code=403, detail="회원가입이 비활성화되어 있습니다. 관리자에게 문의하세요.")
-        _enforce_password_policy(req.password)
+            raise http_error(403, "auth.registration_disabled", lang)
+        _enforce_password_policy(req.password, lang)
         email = normalize_email(req.email)
         users = load_users()
         if email in users:
-            raise HTTPException(status_code=400, detail="이미 존재하는 이메일입니다.")
+            raise http_error(400, "auth.email_taken", lang)
         role = "admin" if not users else "user"
         users[email] = {
             "password": hash_password(req.password),
@@ -140,14 +136,15 @@ def create_auth_router(
 
     @router.post("/login")
     async def login(req: UserLogin, request: Request):
+        lang = resolve_language(request)
         check_ip_rate_limit(client_ip(request), "login", max_calls=10, window_secs=300)
         email = normalize_email(req.email)
         users = load_users()
         user = users.get(email)
         if not user or not verify_and_migrate(email, req.password, user.get("password", ""), users):
-            raise HTTPException(status_code=401, detail="이메일 또는 비밀번호가 틀렸습니다.")
+            raise http_error(401, "auth.bad_credentials", lang)
         if user.get("disabled"):
-            raise HTTPException(status_code=403, detail="비활성화된 계정입니다.")
+            raise http_error(403, "auth.account_disabled", lang)
         role = get_user_role(email, users)
         token = create_session(email)
         response = JSONResponse(content={
@@ -174,10 +171,11 @@ def create_auth_router(
 
     @router.get("/auth/sso/login")
     async def sso_login(request: Request):
+        lang = resolve_language(request)
         settings = get_sso_settings()
         discovery = await get_sso_discovery()
         if not settings.get("enabled") or not discovery:
-            raise HTTPException(status_code=503, detail="SSO가 설정되지 않았습니다.")
+            raise http_error(503, "sso.not_configured", lang)
         state = secrets.token_urlsafe(16)
         nonce = secrets.token_urlsafe(16)
         # PKCE (S256): bind the token exchange to this login, so an
@@ -214,16 +212,17 @@ def create_auth_router(
         return RedirectResponse(f"{discovery['authorization_endpoint']}?{params}")
 
     @router.get("/auth/sso/callback")
-    async def sso_callback(code: str = "", state: str = "", error: str = ""):
+    async def sso_callback(request: Request, code: str = "", state: str = "", error: str = ""):
+        lang = resolve_language(request)
         entry = _sso_states.pop(state, None)
         if entry is None or time.time() - entry.issued_at > 300:
-            raise HTTPException(status_code=400, detail="유효하지 않은 SSO 상태입니다.")
+            raise http_error(400, "sso.invalid_state", lang)
         if error:
             return RedirectResponse(f"/?{urlencode({'sso_error': error})}")
         settings = get_sso_settings()
         discovery = await get_sso_discovery()
         if not settings.get("enabled") or not discovery:
-            raise HTTPException(status_code=503, detail="SSO 설정 오류입니다.")
+            raise http_error(503, "sso.config_error", lang)
         import httpx as _httpx
         async with _httpx.AsyncClient() as c:
             r = await c.post(discovery["token_endpoint"], data={
@@ -237,7 +236,7 @@ def create_auth_router(
             tokens = r.json()
         id_token = tokens.get("id_token")
         if not id_token:
-            raise HTTPException(status_code=400, detail="ID 토큰을 받지 못했습니다.")
+            raise http_error(400, "sso.no_id_token", lang)
         # Never trust a decoded JWT payload: verify signature (against the
         # provider JWKS), issuer, audience, expiry and the login nonce before
         # using any claim. Any failure is fail-closed (401).
@@ -253,20 +252,17 @@ def create_auth_router(
             )
         except OIDCValidationError as exc:
             logging.warning("SSO ID token rejected: %s", exc)
-            raise HTTPException(status_code=401, detail="SSO 토큰 검증에 실패했습니다.")
+            raise http_error(401, "sso.token_verification_failed", lang)
         except Exception as exc:  # discovery/JWKS fetch failure → fail closed
             logging.warning("SSO token validation error: %s", exc)
-            raise HTTPException(status_code=502, detail="SSO 공급자 검증에 실패했습니다.")
+            raise http_error(502, "sso.provider_verification_failed", lang)
         email = normalize_email(payload.get("email") or payload.get("preferred_username") or payload.get("upn") or "")
         if not email:
-            raise HTTPException(status_code=400, detail="이메일을 확인할 수 없습니다.")
+            raise http_error(400, "sso.email_unavailable", lang)
         users = load_users()
         if email not in users:
             if invite_gate_enabled and not entry.invite_authorized:
-                raise HTTPException(
-                    status_code=403,
-                    detail="신규 SSO 계정에는 유효한 서명 초대 권한이 필요합니다.",
-                )
+                raise http_error(403, "sso.invitation_required", lang)
             is_first = len(users) == 0
             users[email] = {
                 "password": "",
@@ -280,7 +276,7 @@ def create_auth_router(
                 ensure_identity(email, users[email])
             save_users(users)
         if users[email].get("disabled"):
-            raise HTTPException(status_code=403, detail="비활성화된 계정입니다.")
+            raise http_error(403, "auth.account_disabled", lang)
         token = create_session(email)
         resp = RedirectResponse("/app", status_code=302)
         resp.set_cookie(
@@ -309,33 +305,35 @@ def create_auth_router(
 
     @router.post("/account/change-password")
     async def change_password(req: ChangePasswordRequest, request: Request):
+        lang = resolve_language(request)
         email = normalize_email(require_user(request))
         if not email:
-            raise HTTPException(status_code=401, detail="인증이 필요합니다.")
-        _enforce_password_policy(req.new_password)
+            raise http_error(401, "auth.login_required", lang)
+        _enforce_password_policy(req.new_password, lang)
         users = load_users()
         user = users.get(email)
         if not user:
-            raise HTTPException(status_code=404, detail="사용자를 찾을 수 없습니다.")
+            raise http_error(404, "auth.user_not_found", lang)
         if not verify_and_migrate(email, req.current_password, user.get("password", ""), users):
-            raise HTTPException(status_code=401, detail="현재 비밀번호가 틀렸습니다.")
+            raise http_error(401, "auth.current_password_wrong", lang)
         users[email]["password"] = hash_password(req.new_password)
         save_users(users)
         return {"status": "ok", "message": "비밀번호가 변경되었습니다."}
 
     @router.patch("/account/profile")
     async def update_profile(req: UpdateProfileRequest, request: Request):
+        lang = resolve_language(request)
         email = normalize_email(require_user(request))
         if not email:
-            raise HTTPException(status_code=401, detail="인증이 필요합니다.")
+            raise http_error(401, "auth.login_required", lang)
         if req.name is not None and not req.name.strip():
-            raise HTTPException(status_code=400, detail="이름을 입력해주세요.")
+            raise http_error(400, "auth.name_required", lang)
         if req.nickname is not None and not req.nickname.strip():
-            raise HTTPException(status_code=400, detail="닉네임을 입력해주세요.")
+            raise http_error(400, "auth.nickname_required", lang)
         users = load_users()
         user = users.get(email)
         if not user:
-            raise HTTPException(status_code=404, detail="사용자를 찾을 수 없습니다.")
+            raise http_error(404, "auth.user_not_found", lang)
         if req.name is not None:
             users[email]["name"] = req.name.strip()
         if req.nickname is not None:
@@ -345,15 +343,16 @@ def create_auth_router(
 
     @router.get("/account/profile")
     async def get_profile(request: Request):
+        lang = resolve_language(request)
         email = normalize_email(require_user(request))
         if not email:
             if require_auth:
-                raise HTTPException(status_code=401, detail="인증이 필요합니다.")
+                raise http_error(401, "auth.login_required", lang)
             return {"email": "", "name": "Local User", "nickname": "You", "role": "admin", "is_admin": True}
         users = load_users()
         user = users.get(email)
         if not user:
-            raise HTTPException(status_code=404, detail="사용자를 찾을 수 없습니다.")
+            raise http_error(404, "auth.user_not_found", lang)
         role = get_user_role(email, users)
         return {"email": email, "name": user.get("name", ""), "nickname": user.get("nickname", ""),
                 "role": role, "is_admin": role == "admin"}

package/latticeai/api/browser.py

@@ -29,6 +29,7 @@ from pydantic import BaseModel
 from lattice_brain.ingestion import IngestionItem, capture_quality_verdict
 from latticeai import __version__
 from latticeai.api.workspace_scope import resolve_workspace_scope
+from latticeai.core.messages import DEFAULT_LANGUAGE, http_error, resolve_language
 from latticeai.core.quiet import quiet
 
 MAX_TAB_BYTES = 4 * 1024 * 1024          # 4 MB per captured tab payload
@@ -395,9 +396,9 @@ def create_browser_router(
     router = APIRouter()
     _fetch = fetch_url or _default_fetch_url
 
-    def _require_pipeline():
+    def _require_pipeline(language: str = DEFAULT_LANGUAGE):
         if pipeline is None or not pipeline.available():
-            raise HTTPException(status_code=503, detail="Knowledge Graph ingestion is disabled.")
+            raise http_error(503, "capture.ingestion_disabled", language)
 
     def _write_workspace(request: Request, body_workspace: Optional[str], user: str) -> Optional[str]:
         return resolve_workspace_scope(
@@ -412,7 +413,7 @@ def create_browser_router(
     async def read_url(req: ReadUrlRequest, request: Request):
         """Fetch a public URL locally and ingest it as a web_url source."""
         user = require_user(request)
-        _require_pipeline()
+        _require_pipeline(resolve_language(request))
         workspace_id = _write_workspace(request, req.workspace_id, user)
         url = _validate_http_url(req.url)
         try:
@@ -443,7 +444,7 @@ def create_browser_router(
     async def ingest_current_tab(req: IngestTabRequest, request: Request):
         """Ingest a payload captured from the local browser extension."""
         user = require_user(request)
-        _require_pipeline()
+        _require_pipeline(resolve_language(request))
         workspace_id = _write_workspace(request, req.workspace_id, user)
         url = _validate_http_url(req.url)
         # Bound the entire capture, not merely each field independently. The
@@ -462,14 +463,14 @@ def create_browser_router(
             if value
         )
         if captured_bytes > max_tab_bytes:
-            raise HTTPException(status_code=413, detail="Captured payload is too large.")
+            raise http_error(413, "capture.payload_too_large", resolve_language(request))
         text = (req.text or "").strip()
         if not text and req.html:
             _title, text = extract_readable_text(req.html)
         if not text:
             text = (req.selected_text or "").strip()
         if not text:
-            raise HTTPException(status_code=400, detail="No text, html, or selected_text provided.")
+            raise http_error(400, "capture.nothing_to_capture", resolve_language(request))
         res = pipeline.ingest(
             IngestionItem(
                 source_type="browser_tab",

package/latticeai/api/chat.py

@@ -51,6 +51,7 @@ from latticeai.api.chat_hybrid import (
 )
 from latticeai.api.chat_intents import ChatIntentController
 from latticeai.api.chat_stream import stream_chat
+from latticeai.core.messages import DEFAULT_LANGUAGE, resolve_language, translate
 from latticeai.core.project_sessions import ProjectSessionStore
 from latticeai.core.run_store import AgentRunStore
 from latticeai.services.app_context import AppContext
@@ -122,12 +123,13 @@ def create_chat_router(context: AppContext) -> APIRouter:
     def authenticated_identity(
         current_user: str,
         claimed_email: Optional[str],
+        language: str = DEFAULT_LANGUAGE,
     ) -> Optional[str]:
         if current_user and claimed_email:
             if current_user.strip().lower() != claimed_email.strip().lower():
                 raise HTTPException(
                     status_code=403,
-                    detail="user_email must match the authenticated user.",
+                    detail=translate("common.user_mismatch", language),
                 )
         return current_user or claimed_email or None
 
@@ -239,12 +241,12 @@ def create_chat_router(context: AppContext) -> APIRouter:
         notify=notify_chat_message,
     )
 
-    def request_model(model_id: Optional[str]) -> Optional[str]:
+    def request_model(model_id: Optional[str], language: str = DEFAULT_LANGUAGE) -> Optional[str]:
         selected = model_id or model_router.current_model_id
         if model_id and model_id not in model_router.loaded_model_ids:
             raise HTTPException(
                 status_code=404,
-                detail=f"Model '{model_id}' not loaded.",
+                detail=translate("chat.model_not_loaded", language, model=model_id),
             )
         return selected
 
@@ -258,7 +260,7 @@ def create_chat_router(context: AppContext) -> APIRouter:
             len(req.image_data) if req.image_data else 0,
             len(req.message or ""),
         )
-        effective_email = authenticated_identity(current_user, req.user_email)
+        effective_email = authenticated_identity(current_user, req.user_email, resolve_language(request))
         workspace_id = write_workspace(
             workspace_scope_from_request(request),
             current_user,
@@ -293,7 +295,7 @@ def create_chat_router(context: AppContext) -> APIRouter:
                 history_user=history_user,
             )
 
-        selected_model_id = request_model(req.model)
+        selected_model_id = request_model(req.model, resolve_language(request))
         file_intent = is_file_action_request(req.message)
         if file_intent and context.funnel_metrics is not None:
             context.funnel_metrics.increment("file_requests")
@@ -303,11 +305,12 @@ def create_chat_router(context: AppContext) -> APIRouter:
                 model_id=selected_model_id,
                 effective_email=effective_email,
                 workspace_id=workspace_id,
+                language=resolve_language(request),
             )
             if direct_response is not None:
                 return direct_response
         if not selected_model_id:
-            return intent_controller.no_model_response()
+            return intent_controller.no_model_response(resolve_language(request))
         if file_intent:
             return await intent_controller.route_file_to_agent(
                 req,

package/latticeai/api/chat_agent_http.py

@@ -29,6 +29,7 @@ from latticeai.api.chat_helpers import (
 )
 from latticeai.api.chat_stream import agent_live_stream
 from latticeai.core.agent import AgentRunContext, AgentState, normalize_plan
+from latticeai.core.messages import resolve_language
 from latticeai.core.quiet import quiet
 from latticeai.core.run_explain import explain_run
 
@@ -266,7 +267,7 @@ class AgentHTTPController:
         """
         current_user = self.require_user(request)
         self.enforce_rate_limit(current_user, "agent")
-        effective_email = self.authenticated_identity(current_user, req.user_email)
+        effective_email = self.authenticated_identity(current_user, req.user_email, resolve_language(request))
         header_workspace = workspace_scope_from_request(request)
         if req.workspace_id and header_workspace and req.workspace_id != header_workspace:
             raise HTTPException(

package/latticeai/api/chat_history.py

@@ -9,7 +9,9 @@ from __future__ import annotations
 from dataclasses import dataclass
 from typing import Any, Callable, Dict
 
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Request
+
+from latticeai.core.messages import http_error, resolve_language
 
 
 @dataclass(frozen=True)
@@ -48,7 +50,7 @@ def register_history_routes(router: APIRouter, deps: HistoryRouteDependencies) -
             **deps.scope_for_user(current_user),
         )
         if not messages:
-            raise HTTPException(status_code=404, detail="대화를 찾을 수 없습니다.")
+            raise http_error(404, "chat.conversation_not_found", resolve_language(request))
         return {"id": conversation_id, "messages": messages}
 
     @router.delete("/history/conversations/{conversation_id:path}")

package/latticeai/api/chat_intents.py

@@ -31,9 +31,10 @@ from latticeai.core.file_generation import (
     repair_bundle_references,
     validate_project_bundle,
 )
+from latticeai.core.messages import DEFAULT_LANGUAGE, translate
 
 
-def next_available_path(root: Path, target: str) -> str:
+def next_available_path(root: Path, target: str, language: str = DEFAULT_LANGUAGE) -> str:
     """Return ``target`` unchanged, or a ``name_2.ext``-style variant when the
     file already exists in the workspace.
 
@@ -54,7 +55,7 @@ def next_available_path(root: Path, target: str) -> str:
             return str(Path(target).with_name(variant.name))
     raise HTTPException(
         status_code=409,
-        detail=f"'{target}' 이름의 파일이 너무 많습니다. 다른 이름을 지정해 주세요.",
+        detail=translate("chat.file_name_collision", language, name=target),
     )
 
 
@@ -118,14 +119,10 @@ class ChatIntentController:
         except Exception as exc:  # noqa: BLE001 — metrics must never break chat
             logging.warning("funnel metrics increment failed: %s", exc)
 
-    def no_model_response(self) -> JSONResponse:
-        detail = "No model loaded. Call /models/load first."
+    def no_model_response(self, language: str = DEFAULT_LANGUAGE) -> JSONResponse:
+        detail = translate("chat.no_model_loaded", language)
         if self.config.is_public:
-            detail = (
-                "No public model loaded. Set OPENAI_API_KEY and "
-                f"LATTICEAI_PUBLIC_MODEL={self.public_model}, or call /models/load "
-                "with an OpenAI-compatible model."
-            )
+            detail = translate("models.public_model_missing", language, model=self.public_model)
         return JSONResponse(
             status_code=400,
             content={
@@ -249,6 +246,7 @@ class ChatIntentController:
         model_id: Optional[str],
         effective_email: Optional[str] = None,
         workspace_id: Optional[str] = None,
+        language: str = DEFAULT_LANGUAGE,
     ):
         # An explicit path ("report.txt") wins; otherwise infer one from an
         # explicit type keyword ("html 파일 만들어줘") so weak models never
@@ -266,19 +264,20 @@ class ChatIntentController:
                     model_id=model_id,
                     effective_email=effective_email,
                     workspace_id=workspace_id,
+                    language=language,
                 )
         target_path = explicit_target or infer_file_target(req.message)
         if not target_path:
             return None
         # Never silently overwrite: an existing target gets a _2/_3 suffix so
         # regeneration is safe and repeatable without the proposal flow.
-        deduped_path = next_available_path(self.agent_root, target_path)
+        deduped_path = next_available_path(self.agent_root, target_path, language)
         renamed = deduped_path != target_path
         target_path = deduped_path
         content = inline_file_action_content(req.message)
         generation_meta: Optional[Dict[str, Any]] = None
         if content is None and not model_id:
-            return self.no_model_response()
+            return self.no_model_response(language)
         if content is None and model_id:
             # Model-agnostic pipeline: strict extension-aware prompt →
             # extraction → validation → one corrective retry → deterministic
@@ -302,7 +301,7 @@ class ChatIntentController:
         if content is None:
             raise HTTPException(
                 status_code=400,
-                detail="File content could not be generated.",
+                detail=translate("chat.file_generation_failed", language),
             )
         try:
             result = self.execute_tool(
@@ -395,6 +394,7 @@ class ChatIntentController:
         model_id: Optional[str],
         effective_email: Optional[str] = None,
         workspace_id: Optional[str] = None,
+        language: str = DEFAULT_LANGUAGE,
     ):
         """Artifact Loop: manifest → per-file generate/validate → bundle write.
 
@@ -405,8 +405,8 @@ class ChatIntentController:
         standard ``artifacts[]`` contract, and downloadable as a zip.
         """
         if not model_id:
-            return self.no_model_response()
-        project_dir = next_available_path(self.agent_root, manifest["name"])
+            return self.no_model_response(language)
+        project_dir = next_available_path(self.agent_root, manifest["name"], language)
         bundle_files = [str(f["path"]) for f in manifest["files"]]
 
         async def _generate(context: str) -> str:

package/latticeai/api/knowledge_graph.py

@@ -19,6 +19,7 @@ from latticeai.api.workspace_scope import (
     resolve_workspace_scope,
     workspace_scope_from_request,
 )
+from latticeai.core.messages import http_error, resolve_language
 from latticeai.core.quiet import quiet
 
 
@@ -456,9 +457,9 @@ def create_knowledge_graph_router(
     async def knowledge_graph_neighbors(node_id: str, request: Request):
         kg, allowed = _scoped(request)
         if not node_id:
-            raise HTTPException(status_code=400, detail="node_id required")
+            raise http_error(400, "graph.node_id_required", resolve_language(request))
         if allowed is not None and not _filter_scoped(kg, [{"id": node_id}], allowed):
-            raise HTTPException(status_code=404, detail="node not found")
+            raise http_error(404, "graph.node_not_found", resolve_language(request))
         payload = kg.neighbors(node_id)
         if allowed is not None:
             neighbors = _filter_scoped(kg, payload.get("neighbors", []), allowed)
@@ -476,13 +477,13 @@ def create_knowledge_graph_router(
         current_user = require_user(request)
         if current_user and req.user_email:
             if current_user.strip().lower() != req.user_email.strip().lower():
-                raise HTTPException(status_code=403, detail="user_email must match the authenticated user.")
+                raise http_error(403, "common.user_mismatch", resolve_language(request))
         effective_user = current_user or req.user_email or None
         kg = graph()
         workspace_id = _write_workspace(request, current_user)
         event_type = (req.type or "").strip().lower()
         if event_type not in {"message", "ai_response", "note"}:
-            raise HTTPException(status_code=400, detail="지원하는 type: message, ai_response, note")
+            raise http_error(400, "graph.unsupported_type", resolve_language(request))
         role = req.role or ("assistant" if event_type == "ai_response" else "user")
         if ingestion_pipeline is not None:
             source_type = "chat_message" if event_type in {"message", "ai_response"} else "note"

package/latticeai/api/local_files.py

@@ -15,6 +15,12 @@ from fastapi.responses import FileResponse
 from pydantic import BaseModel
 
 from latticeai.api.knowledge_graph import create_knowledge_graph_router
+from latticeai.core.messages import (
+    DEFAULT_LANGUAGE,
+    http_error,
+    resolve_language,
+    translate,
+)
 from latticeai.services.local_knowledge import create_local_knowledge_router
 from latticeai.tools import local_list, local_read, local_write
 
@@ -234,20 +240,20 @@ def create_local_files_router(
         )
         target = Path(path).expanduser().resolve()
         if not target.exists() or not target.is_file():
-            raise HTTPException(status_code=404, detail="File not found")
+            raise http_error(404, "common.file_not_found", resolve_language(request))
         return FileResponse(str(target))
 
     # ── v9.8.0 ingestion jobs API (frozen paths — consumed by the frontend) ───
     def _require_pipeline():
         if ingestion_pipeline is None or not ingestion_pipeline.available():
-            raise HTTPException(status_code=503, detail="Knowledge Graph ingestion is disabled.")
+            raise http_error(503, "capture.ingestion_disabled", DEFAULT_LANGUAGE)
 
     def _ingestion_write_workspace(request: Request, body_workspace: Optional[str], user: str) -> Optional[str]:
         header = request.headers.get("X-Workspace-Id")
         header = header.strip() if header and header.strip() else None
         supplied = [value for value in (body_workspace, header) if value]
         if len(set(supplied)) > 1:
-            raise HTTPException(status_code=403, detail="Workspace selectors must match.")
+            raise http_error(403, "common.workspace_mismatch", resolve_language(request))
         requested = supplied[0] if supplied else None
         if workspace_service is None:
             return requested
@@ -271,7 +277,7 @@ def create_local_files_router(
         _require_pipeline()
         job = ingestion_pipeline.get_background_job(job_id)
         if job is None:
-            raise HTTPException(status_code=404, detail="ingestion job not found")
+            raise http_error(404, "ingestion.job_not_found", resolve_language(request))
         return job.as_dict()
 
     @router.post("/api/ingestion/jobs/{job_id}/resume")
@@ -281,7 +287,7 @@ def create_local_files_router(
         _require_pipeline()
         job = ingestion_pipeline.get_background_job(job_id)
         if job is None:
-            raise HTTPException(status_code=404, detail="ingestion job not found")
+            raise http_error(404, "ingestion.job_not_found", resolve_language(request))
         if job.status == "running":
             return {"status": "already_running", "job_id": job_id, "job": job.as_dict()}
         remaining = len(job.remaining_indices())
@@ -312,7 +318,7 @@ def create_local_files_router(
         workspace_id = _ingestion_write_workspace(request, req.workspace_id, current_user)
         path = (req.path or "").strip()
         if not path:
-            raise HTTPException(status_code=400, detail="path is required.")
+            raise http_error(400, "common.path_required", resolve_language(request))
         if not req.approved:
             return permission_gateway.local_permission_response(path, "read", current_user)
         permission_gateway.require_local_approval(
@@ -339,16 +345,16 @@ def create_local_files_router(
         return summary
 
     # ── folder watch mode: opt-in, off by default (backlog #8) ────────────────
-    def _require_folder_watch():
+    def _require_folder_watch(request: Request):
         _require_pipeline()
         if folder_watch is None:
-            raise HTTPException(status_code=503, detail="Folder watch service is unavailable.")
+            raise http_error(503, "ingestion.watch_unavailable", resolve_language(request))
 
     @router.get("/api/ingestion/watch")
     async def folder_watch_status(request: Request):
         """Watch-mode status: stored opt-ins, poller state, last scan results."""
         require_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         return folder_watch.status()
 
     @router.post("/api/ingestion/watch")
@@ -361,11 +367,11 @@ def create_local_files_router(
         watch owner's workspace scope).
         """
         current_user = permission_gateway.require_local_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         workspace_id = _ingestion_write_workspace(request, req.workspace_id, current_user)
         path = (req.path or "").strip()
         if not path:
-            raise HTTPException(status_code=400, detail="path is required.")
+            raise http_error(400, "common.path_required", resolve_language(request))
         if not req.approved:
             return permission_gateway.local_permission_response(path, "read", current_user)
         permission_gateway.require_local_approval(
@@ -381,7 +387,11 @@ def create_local_files_router(
             recursive=req.recursive,
         )
         if result.get("status") != "ok":
-            raise HTTPException(status_code=400, detail=result.get("detail") or "watch enable failed")
+            raise HTTPException(
+                status_code=400,
+                detail=result.get("detail")
+                or translate("ingestion.watch_enable_failed", resolve_language(request)),
+            )
         return result
 
     @router.delete("/api/ingestion/watch")
@@ -392,12 +402,12 @@ def create_local_files_router(
     ):
         """Opt back out of watch mode (removes the stored consent record)."""
         require_user(request)
-        _require_folder_watch()
+        _require_folder_watch(request)
         if not watch_id and not path:
-            raise HTTPException(status_code=400, detail="watch_id or path is required.")
+            raise http_error(400, "ingestion.watch_selector_required", resolve_language(request))
         result = folder_watch.disable(watch_id=watch_id, path=path)
         if result.get("status") == "not_found":
-            raise HTTPException(status_code=404, detail="watch not found")
+            raise http_error(404, "ingestion.watch_not_found", resolve_language(request))
         return result
 
     @router.post("/local/write")