Addon Expert installs, updates, and tracks ExpressionEngine add-ons from the control panel — ZIP uploads, GitHub releases, one-click updates, supply-chain checks, and compatibility overrides. This covers every screen and how the pieces fit.
Copy the addon_expert/ folder into system/user/addons/, then open Developer → Add-Ons in the control panel, find Addon Expert, and click Install. Its screens then live under Developer → Add-Ons → Addon Expert: Install ZIP, Packages, Releases, Audit Log, and Settings.
Upgrading from the original Addon Manager + (addon_installer)? Install Addon Expert and your config — GitHub mappings, trust anchors, settings, overrides, and the release cache — is copied across automatically. Confirm it carried over, then uninstall the old add-on.
Upload an add-on ZIP and Addon Expert detects the real add-on folder from its addon.setup.php and extracts it into the add-ons directory — no FTP.
vendor-package/my_addon/addon.setup.php; the folder holding addon.setup.php is used.The upload is inspected and scanned before anything is written. A compatible package extracts and installs straight through. An incompatible one (declaring a newer PHP/EE than your server) is held on a confirm screen showing the unmet requirement, a compatibility-scan verdict, and a one-click Force or Cancel — so a wrong-environment package never silently lands, and you never re-select the file. See Compatibility & force override.
Every detected package appears as a card. Actions use ExpressionEngine's own install / update / settings / uninstall flow.
| Badge | Meaning |
|---|---|
| Installed / Not Installed | Whether EE currently has the add-on installed. |
| Update Available | Newer files are on disk than EE has recorded. |
GitHub: vX.Y.Z ↗ | A newer release exists on the mapped repo — links to it. |
| ⚠ incompatible | The package's declared PHP/EE requirement isn't met here. |
| ⚠ requirement override | Force-installed past its requirement; shows the original requirement and the scan verdict from force time. |
The Download action exports any detected add-on as a ZIP, generated on demand and not stored.
Point an add-on at a GitHub repo and Addon Expert polls /releases/latest, compares it to the installed version, and surfaces a pending-update badge plus a sidebar count.
An add-on's addon.setup.php can declare its own source:
'github_repo' => 'owner/repo',Shown read-only on the Releases screen — no admin action needed.
For add-ons whose author didn't declare one, type owner/repo into the Releases row. Saved to system/user/config/addon_expert_mappings.json. A manifest declaration always wins over an admin mapping.
Results cache for 1 hour; stale entries refresh in parallel when the Releases screen loads. Check for updates forces a full refresh of every mapping. GitHub API calls are unauthenticated — public repos only (60 requests/hour per IP, far above any real site's needs).
When a newer release exists, install it in one click. Addon Expert:
.zip asset, then the source zipball. Downloads are capped at 100 MB.system/user/cache/addon_expert/backups/ — outside the add-ons directory, so EE never tries to load it. One rolling backup per add-on.After the swap, the EE-side update step (the add-on's upd.php plus the version-row bump) runs automatically the next time you load an Addon Expert screen — so you don't have to go to Developer → Add-Ons and click Update. This applies to manual ZIP uploads too. A banner reports the from→to versions, or "nothing to do" if the version already matched. Toggle it in Settings.
A GitHub repo can change hands, or be deleted and re-claimed under the same owner/repo name (RepoJacking). Addon Expert treats every install as a supply-chain decision.
system/user/config/addon_expert_trust.json.✓ trusted / ⚠ CHANGED / unverified), with a Reconfirm trust action to accept a legitimate change. Reconfirming is itself audit-logged.Every install, failure, block, trust pin, override, and auto-finalize is written to system/user/cache/addon_expert/install.log (JSONL) and shown on the Audit Log screen — with per-event-type counts, a self-update flag, and grep recipes for the raw file.
ExpressionEngine refuses to install an add-on that declares a newer PHP or EE than the server runs. Addon Expert reads the same requires block and surfaces that verdict earlier — before extracting on upload, and before the swap on a GitHub install.
Sometimes an author sets a conservative baseline the code doesn't actually need. When you choose Override version requirements, Addon Expert first runs a heuristic feature scan of the package's PHP and tells you whether anything newer than your version is actually used:
json_validate() (PHP 8.3) — forcing onto 8.2 will fatal when that code runs."Forcing patches the add-on's declared requirement so EE accepts it, records the original, flags the add-on with a requirement-override badge, and re-applies the patch on future updates.
call_user_func('json_validate', …)) or eval. Treat it as an informed signal, not a guarantee — and remember that forcing an add-on that genuinely uses newer syntax will fatal at runtime.Addons (3). You add the entry once via Settings → Menu Manager (a core EE page); Addon Expert can't force itself into the menu.| Path | Contents |
|---|---|
system/user/config/addon_expert_mappings.json | Admin repo mappings |
system/user/config/addon_expert_trust.json | Pinned trust anchors |
system/user/config/addon_expert_overrides.json | Requirement overrides |
system/user/config/addon_expert_settings.json | Settings-screen options |
system/user/cache/addon_expert/ | Release cache, audit log, backups, and held uploads |
All of it is plain files on your server — nothing is sent anywhere except the public GitHub API calls described above.
ZipArchive (uploads) and cURL (GitHub downloads)... traversal are rejected before extraction.Addon Expert is MIT-licensed and developed in the open at github.com/calimonk/ee-addon-expert. It's a maintained fork of Addon Manager + by Javid Fazaeli.