OpenMES v0.28.0

OpenMES v0.28.0 — Plant overview dashboard, production targets & FPY, installation currency, quality inspector permissions, view switcher

OpenMES v0.28.0 is a feature release for production managers: a live Plant overview dashboard of the running shift, production targets with first-pass yield (FPY), one currency for labour and production costs, quality inspector permissions that let operators run inbound inspections, and a view switcher that lets administrators see the interface as a supervisor or an operator does. It also closes several access-control gaps and fixes timezone handling. It includes the PHP2Shell security fix from v0.27.1 (PHP 8.3.36).

Highlights

Plant overview — a real-time shop-floor dashboard

Admin → Dashboard now opens with the shift running right now, refreshed every 60 seconds: a Live header with the current plant shift and time left, line activity (running, idle, blocked, down — with the stop reason), line cards and a plant summary with output against plan, shift KPI tiles, OEE for this shift (availability, performance, quality), planned vs actual production and output per hour, downtime, and a Needs action list. The existing widgets stay under Last 30 days.

Production targets and first-pass yield (FPY)

Settings → System → Production sets the maximum scrap rate and the minimum first-pass yield, and shows the current shift's FPY. The plant OEE target follows each line's planning efficiency.

One installation currency

Pick one ISO 4217 currency (now including INR) in Settings → System; pay rates, the worker Compensation card and every amount in the Production Cost Report use it.

Quality inspector and Quality disposition permissions

Inbound inspections can be delegated to any person, operators included: Quality inspector runs and completes an inspection; Quality disposition — a separate, higher permission — releases, quarantines or rejects the lot. A new Inspections screen on the operator tablet.

View switcher for administrators

A bar on top of every screen, for Admins only, previews the interface as a Supervisor or an Operator sees it — no second login, no impersonation. While previewing, the bar says plainly that permissions have not changed.

HR: link an account to an existing worker

The account form can link an existing HR worker instead of creating a duplicate profile, and unlink it again. The worker Code field is explained in the forms.

Security

• Inspections API now enforces the same permissions as the panel (it previously required only a login).
• A disposition needs a completed inspection; concurrent decisions no longer create a second lot.
• Creating and editing work orders requires the matching permission, not just access to the Orders tab.
• Patched PHP dependencies — Laravel 12.70.2, Symfony 7.4.22 components and more; composer audit is clean.
• PHP 8.3.36 against PHP2Shell (CVE-2026-109618, CVE-2026-109619), as in v0.27.1.

Fixes

Dashboard OEE gauges and overdue alerts follow the plant timezone, Settings → Tab Access saves again, operators with granted admin tabs get their sidebar back, inspection links no longer 404, the API and the tablet start the same inspection, checkboxes line up with their labels, the sidebar search no longer repeats Settings, and browser calls to /api/v1 no longer return 401 in Docker when SANCTUM_STATEFUL_DOMAINS is empty.

Upgrading

docker compose pull && docker compose up -d     # or: git pull origin main && docker compose build --pull && docker compose up -d

Migrations run on start. Without Docker, also run php artisan db:seed --class=RolesAndPermissionsSeeder --force after migrating so Supervisors keep access to inspections.

Full details in CHANGELOG.md. Thanks to community contributors @Jovinmathew, @AswinArun and @AsteaFrostweb.

---

Installation

Web / self-hosted: download openmmes-v0.28.0.zip below — it is self-contained (PHP dependencies in vendor/ and the built frontend in backend/public/build/ are already bundled, so no composer install or npm build is required).

Desktop: grab the installer for your OS — Windows *-setup.exe, macOS *.dmg, or Linux *.deb / *.rpm. They bundle PHP + the backend and run OpenMES as a local app / LAN server.

Mobile (Android): install openmes-mobile-v0.28.0.apk and point it at your OpenMES server.

Shared hosting (no terminal): unzip the web package, upload the folder, point the document root at the package root, then open the URL — the browser-based setup wizard handles environment, database and the admin account.

Docker: unzip the web package and run docker compose up -d from the package root (or bash install.sh).

Changes

• Merge pull request #392 from Mes-Open/release/0.28.0 (eb184a2)
• Merge develop into release/0.28.0 (d57dc21)
• Merge pull request #393 from Mes-Open/feat/admin-view-switcher (a866e2c)
• feat: view switcher for administrators (4ddd0cc)
• chore(release): 0.28.0 (3904c02)
• Merge pull request #391 from Mes-Open/develop (bfc1b97)
• Merge main (v0.27.1) into develop (43090c0)
• Merge pull request #386 from Mes-Open/feat/issue-scrap-and-line-block (bdd7085)
• Merge pull request #383 from Mes-Open/fix/revision-lifecycle-filter-label (be8800d)
• Merge pull request #385 from AsteaFrostweb/fix/composer-security-advisories (13c7c94)
• Merge pull request #390 from AswinArun/fix/duplicate-settings-search (54723f2)
• fix: stop sidebar search from repeating the Settings row Indexing both the Settings group and the footer link gave two rows the same React key, so each change to the query left another /settings link in the sidebar. (690a48e)
• Merge pull request #389 from Jovinmathew/feat/currency-inr (7819622)
• feat: add INR to selectable currencies (53d3b5a)
• fix(issues): address review findings (af4bb98)
• feat(issues): file issues with block/scrap effect (276946f)
• fix: Update Composer dependencies for security advisories (1a74393)
• Merge pull request #384 from Mes-Open/fix/php2shell (5fd3180)
• fix(security): build on PHP 8.3.36 against PHP2Shell (b8c94a1)
• fix(revisions): translate lifecycle filter options (399cb35)
• Merge pull request #381 from Mes-Open/cez/dashboard-integration (5924337)
• test: accept either case for the compact thousands suffix (10909b9)
• docs: fix changelog after integrating the dashboard branches (8b0fd8b)
• Merge remote-tracking branch 'origin/develop' into cez/dashboard-integration (6b57358)
• Merge pull request #380 from Mes-Open/cez/f6a10c67 (64c5af7)
• fix: plant overview header shows the default shift window and checks the create permission (55d170d)
• test: point the No-data demo spec at the line cards (e80e792)
• Merge branch 'cez/e2d16b01' into cez/dashboard-integration (35915f4)
• Merge branch 'cez/f4b5d3f0' into cez/dashboard-integration (5bafbfb)
• Merge branch 'cez/52e9d27e' into cez/dashboard-integration (0186af0)
• Merge branch 'cez/0a01d7c8' into cez/dashboard-integration (e985236)
• Merge branch 'cez/8b39f60e' into cez/dashboard-integration (82afbda)
• Merge branch 'cez/1066fff4' into cez/dashboard-integration (b0a1f81)
• Merge branch 'cez/c4abbadb' into cez/dashboard-integration (1af9def)
• Merge branch 'cez/6571558e' into cez/dashboard-integration (9f266a2)
• Merge branch 'cez/87be1c11' into cez/dashboard-integration (32219e9)
• Merge branch 'cez/df9d27d1' into cez/dashboard-integration (8f3d6b3)
• Merge branch 'cez/ed10638c' into cez/dashboard-integration (44a5ee8)
• Merge origin/develop into cez/f6a10c67 (0890e41)
• Merge pull request #379 from Mes-Open/cez/5785ecc8 (f631ef3)
• fix: demo output follows the schedule instead of nameplate batches (1e55cd6)
• fix: dashboard page padding and readable output-per-hour bars on phones (b96dd21)
• fix: rank Unclassified among downtime reasons by its minutes (5e635ff)
• fix: show actual output on a fresh demo and where the shift plan comes from (0d2e4f3)
• test: click-through demo for dashboard line cards and summary bar (4092d2d)
• test: click-through demo for dashboard Needs action list (9516a5b)
• feat: line cards and plant summary strip on the dashboard (771fabf)
• test: click-through demo for planned vs actual production dashboard (e13767f)
• fix: measure downtime percentage in line time, cache board total (fd22511)
• fix: gateway heartbeats keep unchanging machines live on the plant overview (1a38baf)
• fix: put the classify link on its own line in the downtime card (b1bba13)
• feat: dashboard "Needs action" list (1e34e7f)
• feat: show the shift downtime total on Plant Board (98a39a5)
• test: click-through demo for shift KPI tiles (77651bc)
• Merge branch 'cez/6571558e' into cez/c4abbadb (94ab287)
• fix: readable planned vs actual chart on phones, per-hour plan markers (1eecf5d)
• test: make downtime demo independent of seed time of day (8c7c31a)
• test: click-through demo for dashboard downtime section (ba513d5)
• feat: planned vs actual production and output per hour on the dashboard (10d1bc8)
• feat: shift KPI tiles on the plant overview dashboard (05083a4)
• test: assert the work-order create 403 renders the friendly Error page (f0b15e5)
• fix: keep hand-logged stops on silent stations visible; touch only from collectors (fe65599)
• feat: downtime section on the admin dashboard plant overview (f65d8d3)
• feat: make work-order permission limits visible in the UI (66a93a6)
• test: click-through demo for lazy production targets (c3f01c7)
• test: click-through demo for work-order create permission (56da5dc)
• fix: read live-delta due dates in the plant zone when judging overdue (0a47008)
• test: make OEE demo robust to live section re-render (c652900)
• test: click-through demo for live shift OEE dashboard section (07d881b)
• feat: live "OEE · this shift" section on the admin dashboard (c571130)
• test: click-through demo for dashboard line activity timeline (140a34b)
• fix: say what the alert count is made of and close the panel on click (4e3e852)
• fix: keep the "No data" line pill readable in light mode (be89492)
• fix: let Settings → Tab Access save when roles share quality grants (5b422e2)
• cezar autosave (run finalize) (d749358)
• feat: line activity timeline and uptime on the admin dashboard (693d743)
• test: click-through demo for plant-timezone alert count (47e0dcf)
• test: click-through demo for plant overview time left and No data lines (4e0eb45)
• fix: show the plant-date overdue boundary on the Alerts page (8d95ecf)
• fix: restore operator sidebar listing granted admin tabs (3c3331b)
• test: click-through demo for work-order create permission (a18810f)
• test: retry opening the work order drawer in the demo spec (8106688)
• test: click-through demo for plant-timezone alert count (07d74cf)
• Merge branch 'cez/f6a10c67' into cez/dashboard-base (d390d91)
• fix: plant overview review fixes — time left rounding, "No data" for silent collectors (5d624d4)
• fix: enforce work-order create/edit permissions on web forms (d7d1e1f)
• fix: address PR #380 review — OEE target statuses, FPY aggregate, lazy targets card (7477e52)
• fix: count overdue alerts by the plant timezone's date, not UTC (452874d)
• test: click-through demo for production targets (03d69b5)
• test: click-through demo for plant overview dashboard header (f7ffa08)
• feat: plant overview header and live line states on the admin dashboard (e00da32)
• feat: production targets — OEE target from line planning efficiency, scrap/FPY settings, first-pass yield (8589c57)
• Merge pull request #378 from SoiBien-AI/feat/translate-develop (87226a3)
• feat(i18n): update Vietnamese translations to match upstream develop (5729b16)
• Merge pull request #376 from Mes-Open/fix/production-tab-review (c9ebcb9)
• Merge pull request #375 from Mes-Open/cez/e4064d01 (f7b03ca)
• Merge origin/develop into fix/production-tab-review (21c74ec)
• fix: restore /api/v1 session auth in Docker, accept product_type view columns, complete PL translations (77e8095)
• Merge remote-tracking branch 'origin/develop' into cez/e4064d01 (1c9c7db)
• Merge pull request #374 from Mes-Open/cez/1a88f0b5 (a4668cb)
• fix: keep untyped materials off other materials' inspection plans (e40e03d)
• test: drop the superseded HR checkbox demo spec (671a442)
• chore: untrack the committed Python bytecode under .claude/skills (2ddd4cd)
• test: rename demo spec to match the resumed branch slug (115c604)
• Merge branch 'cez/c178b39b' into cez/1a88f0b5 (fff3b57)
• test: name the HR checkbox demo spec after this run (28e80ca)
• chore: stop tracking Python bytecode under .claude/skills (7305a43)
• Merge branch 'cez/ea75954c' into cez/e4064d01 (cfeb590)
• Merge pull request #371 from Mes-Open/cez/649ae916 (e6cc32a)
• Merge remote-tracking branch 'origin/develop' into cez/649ae916 (f47b507)
• Merge pull request #372 from Mes-Open/cez/ba8c76db (fc74529)
• Merge remote-tracking branch 'origin/develop' into cez/ba8c76db (8e2ba4b)
• Merge remote-tracking branch 'origin/develop' into cez/649ae916 (71e888b)
• test: click-through demo for HR checkbox alignment (c4cf1c4)
• cezar autosave (run finalize) (59700ed)
• cezar autosave (run finalize) (d2852e0)
• cezar autosave (turn end) (2de8bff)
• fix: refuse dispositions on pending inspections and align tablet with API (8a1bd42)
• Merge branch 'cez/b7a087e0' into cez/ea75954c (4b7a403)
• test: rename click-through demo spec to current branch slug (9984c03)
• test: rename demo spec to match the resumed branch slug (0d57276)
• fix: relabel amounts in the old installation currency when it changes (a81123c)
• fix: point admin inspection links at the inspection screens (ff747a1)
• chore: stop tracking the e2e instance database (1903a27)
• Merge pull request #370 from Mes-Open/cez/f39c02be (a9b27ab)
• chore: untrack the local e2e instance database (c0ec160)
• fix: default new materials to the installation currency and flag foreign-currency cost lines (c55de89)
• fix: label the disposition section 'Change disposition' once a decision exists (a88ebbc)
• cezar autosave (run finalize) (2951d6d)
• cezar autosave (run finalize) (8a37312)
• test: click-through demo for linking a user account to an HR worker (c7f7843)
• test: click-through demo for quality inspector permission (35b14d5)
• fix: flush Inertia prefetch cache after saving system settings (501533a)
• test: click-through demo for installation currency (f85dd82)
• fix: keep HR worker data intact when editing a linked account (d85609c)
• cezar autosave (turn end) (ba911bb)
• fix: make example-company inspection plans usable on the operator tablet (aa3468e)
• cezar autosave (turn end) (4ecf48f)
• test: click-through demo for linking a user account to an HR worker (d19b9d6)
• chore: raise the PHPUnit memory limit to 1G for the full suite (7b78dcb)
• fix: ignore the e2e instance database and link code hints to their inputs (5fa5185)
• i18n: add missing Polish translations to restore en/pl key parity (c042a69)
• test: click-through demo for worker code hint (edff9fe)
• fix: align checkboxes with their labels in HR forms (b62c549)
• feat: quality inspector and disposition permissions for inbound inspections (d6aadc4)
• feat: link a user account to an existing HR worker (daa132b)
• i18n: add the Polish strings missing since the Vietnamese sync (5f5f562)
• feat: one installation currency for pay rates and production costs (fd4438e)
• i18n: add Polish translations for keys missing from pl.json (1825574)
• i18n: add Polish translations missing from pl.json (9623266)
• feat: explain the worker code field in worker and account forms (da1fd68)
• Merge pull request #367 from SoiBien-AI/feat/translate-develop (41788cc)
• fix(i18n): wrap remaining activity and system log strings per CodeRabbit review (cd335ff)
• feat(i18n): wrap hardcoded UI strings and update Vietnamese translations (6f4d1fb)
• Merge pull request #366 from Mes-Open/chore/sync-main-0.27.0-into-develop (1c8c0ac)