Create a client side package database
Currently you're reading the meta.yaml from the filesystem over and over again, there should be a client side database with all packages installed, this would also resolve the issue that you have conflicting packages as the package name can only be unique, and you can save the source of the package there,
my current idea is just a big packages.json
(why json? my policy is user generated in yaml and system generated in json), as key-value store for all packages.