Console
The management console provides traffic charts and a message-access form for administrators. It listens on console_port, using port 5544 and files from the console directory in the local example. Configure its certificate and root directory in mesgd.config.
The console has its own TLS certificate settings. It is a different listener from the main HTTPS port. The account UI at /account stays on the main port.
Access and authentication
Static files, including the login page, can load without a session. Mounted handlers require authentication unless {disable_auth, true} is set. The following routes dispatch to their own handlers before that generic check; those handlers enforce the account or administrator credentials appropriate to the operation:
/auth/loginand/auth/logout/auth/admin/statistics//auth/admin/samples- the grant routes used by message access
A missing file returns HTTP 200 with an empty body. mesgd drops ., .., /, and empty segments before it joins the path under console_root, so a request cannot walk out of that directory. A directory request looks for index.html.
Statistics and message access need an administrator session. A missing bearer is 401. A signed-in user who is not in {admin, Name} or auth_admins is 403.
Traffic charts
The statistics page discovers available charts and requests a time range for each one. API callers must supply from and to; omitting the range returns 400. Statistics documents the chart catalog, filters, and how to distinguish a gap in collection from zero traffic.
Define access from a sample message
/access.html is the message-access page. Paste a JSON object or array. The form starts with {"room":"lobby","kind":"chat","text":"hello"}. mesgd compiles that sample into a path pattern. You can also ask for role suggestions.
An optional instructions field, at most 2000 characters, goes with the suggestion request. The page rejects empty or whitespace-only instructions, and it rejects JSON that does not parse, before it sends the request.
Suggestion tries a local model first, then Grok, Claude, and ChatGPT when XAI_KEY, CLAUDE_KEY, and OPENAI_KEY are set. Each wait uses that provider's agent timeout. The page does not save a suggestion for you. Saving still goes through the grant API, which checks the pattern. See Grants.
The console reads HTML and scripts from disk. Reload the browser after you edit those files. You do not have to reload a beam.