fix: prevent duplicate VSIX installations by using package.json identity (#16963)

Resolves GH-16845

- Extract extension identity (publisher, name, version) from the VSIX's embedded package.json instead of deriving it from the filename
- Check already-deployed plugins via `getDeployedPluginsById` to block duplicate installations
- Fall back to filename-based ID if package.json cannot be read

Author: rajj28

packages/plugin-ext-vscode/src/node/local-vsix-file-plugin-deployer-resolver.ts

@@ -16,18 +16,19 @@
 
 import * as path from 'path';
 import { inject, injectable } from '@theia/core/shared/inversify';
-import { PluginDeployerResolverContext } from '@theia/plugin-ext';
+import { PluginDeployerResolverContext, PluginDeployerHandler, PluginIdentifiers } from '@theia/plugin-ext';
 import { LocalPluginDeployerResolver } from '@theia/plugin-ext/lib/main/node/resolvers/local-plugin-deployer-resolver';
 import { PluginVSCodeEnvironment } from '../common/plugin-vscode-environment';
 import { isVSCodePluginFile } from './plugin-vscode-file-handler';
-import { existsInDeploymentDir, unpackToDeploymentDir } from './plugin-vscode-utils';
+import { existsInDeploymentDir, unpackToDeploymentDir, extractExtensionIdentityFromVsix } from './plugin-vscode-utils';
 
 @injectable()
 export class LocalVSIXFilePluginDeployerResolver extends LocalPluginDeployerResolver {
     static LOCAL_FILE = 'local-file';
     static FILE_EXTENSION = '.vsix';
 
     @inject(PluginVSCodeEnvironment) protected readonly environment: PluginVSCodeEnvironment;
+    @inject(PluginDeployerHandler) protected readonly pluginDeployerHandler: PluginDeployerHandler;
 
     protected get supportedScheme(): string {
         return LocalVSIXFilePluginDeployerResolver.LOCAL_FILE;
@@ -38,14 +39,48 @@ export class LocalVSIXFilePluginDeployerResolver extends LocalPluginDeployerReso
     }
 
     async resolveFromLocalPath(pluginResolverContext: PluginDeployerResolverContext, localPath: string): Promise<void> {
-        const extensionId = path.basename(localPath, LocalVSIXFilePluginDeployerResolver.FILE_EXTENSION);
+        // Extract the true extension identity from the VSIX package.json
+        // This prevents duplicate installations when the same extension is installed from VSIX files with different filenames
+        // See: https://github.com/eclipse-theia/theia/issues/16845
+        const components = await extractExtensionIdentityFromVsix(localPath);
 
-        if (await existsInDeploymentDir(this.environment, extensionId)) {
-            console.log(`[${pluginResolverContext.getOriginId()}]: Target dir already exists in plugin deployment dir`);
+        if (!components) {
+            // Fallback to filename-based ID if package.json cannot be read
+            // This maintains backward compatibility for edge cases
+            const fallbackId = path.basename(localPath, LocalVSIXFilePluginDeployerResolver.FILE_EXTENSION);
+            console.warn(`[${pluginResolverContext.getOriginId()}]: Could not read extension identity from VSIX, falling back to filename: ${fallbackId}`);
+
+            if (await existsInDeploymentDir(this.environment, fallbackId)) {
+                console.log(`[${pluginResolverContext.getOriginId()}]: Target dir already exists in plugin deployment dir`);
+                return;
+            }
+
+            const fallbackDeploymentDir = await unpackToDeploymentDir(this.environment, localPath, fallbackId);
+            pluginResolverContext.addPlugin(fallbackId, fallbackDeploymentDir);
+            return;
+        }
+
+        const unversionedId = PluginIdentifiers.componentsToUnversionedId(components);
+        const versionedId = PluginIdentifiers.componentsToVersionedId(components);
+
+        // Check if an extension with this identity is already deployed in memory
+        const existingPlugins = this.pluginDeployerHandler.getDeployedPluginsById(unversionedId);
+        if (existingPlugins.length > 0) {
+            const existingVersions = existingPlugins.map(p => p.metadata.model.version);
+            console.log(
+                'Extension ' + unversionedId + ' (version(s): ' + existingVersions.join(', ') + ') is already installed.\n' +
+                'Uninstall the existing extension before installing a new version from VSIX.'
+            );
+            return;
+        }
+
+        // Check if the deployment directory already exists on disk
+        if (await existsInDeploymentDir(this.environment, versionedId)) {
+            console.log(`[${pluginResolverContext.getOriginId()}]: Extension "${versionedId}" already exists in deployment dir`);
             return;
         }
 
-        const extensionDeploymentDir = await unpackToDeploymentDir(this.environment, localPath, extensionId);
-        pluginResolverContext.addPlugin(extensionId, extensionDeploymentDir);
+        const extensionDeploymentDir = await unpackToDeploymentDir(this.environment, localPath, versionedId);
+        pluginResolverContext.addPlugin(versionedId, extensionDeploymentDir);
     }
 }

packages/plugin-ext-vscode/src/node/plugin-vscode-utils.ts

@@ -20,6 +20,50 @@ import * as filenamify from 'filenamify';
 import { FileUri } from '@theia/core/lib/node';
 import * as fs from '@theia/core/shared/fs-extra';
 import { PluginVSCodeEnvironment } from '../common/plugin-vscode-environment';
+import { PluginIdentifiers, PluginPackage } from '@theia/plugin-ext/lib/common/plugin-protocol';
+
+/**
+ * Extracts extension identity from a VSIX file by reading its package.json.
+ *
+ * VSIX files are ZIP archives with the extension content in an `extension/` subdirectory.
+ * This function extracts only the `extension/package.json` file to read the extension metadata.
+ *
+ * @param vsixPath Path to the VSIX file
+ * @returns PluginIdentifiers.Components (publisher?, name, version), or undefined if the package.json cannot be read or is invalid
+ */
+export async function extractExtensionIdentityFromVsix(vsixPath: string): Promise<PluginIdentifiers.Components | undefined> {
+    try {
+        // Extract only the package.json file from the VSIX
+        const files = await decompress(vsixPath, {
+            filter: file => file.path === 'extension/package.json'
+        });
+
+        if (files.length === 0) {
+            console.warn(`[${vsixPath}]: No extension/package.json found in VSIX`);
+            return undefined;
+        }
+
+        const packageJsonContent = files[0].data.toString('utf8');
+        const packageJson: Partial<PluginPackage> = JSON.parse(packageJsonContent);
+
+        // Validate required fields
+        if (!packageJson.name || !packageJson.version) {
+            console.warn(`[${vsixPath}]: Invalid package.json - missing name or version`);
+            return undefined;
+        }
+
+        const components: PluginIdentifiers.Components = {
+            publisher: packageJson.publisher,
+            name: packageJson.name,
+            version: packageJson.version
+        };
+
+        return components;
+    } catch (error) {
+        console.error(`[${vsixPath}]: Failed to extract extension identity from VSIX`, error);
+        return undefined;
+    }
+}
 
 export async function decompressExtension(sourcePath: string, destPath: string): Promise<boolean> {
     try {