Also check package name validity in InstallPackageRequest

[Jake Bailey (jakebailey)]

Extends #63368 to the code action.

This is still not a security boundary; any client that can send these args can already run commands locally.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds package-name validation to the typings installer’s installPackage request path (code actions), and introduces a new tsserver baseline + unit test to ensure invalid package names are rejected.

Changes:

• Validate InstallPackageRequest.packageName and return a failure response for invalid names.
• Add a unit test that sends crafted applyCodeActionCommand requests with invalid package names.
• Add a new reference baseline capturing the expected rejection behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/baselines/reference/tsserver/codeFix/install-package-rejects-invalid-package-names.js	New baseline verifying invalid package names are rejected during code action application.
src/typingsInstallerCore/typingsInstaller.ts	Adds early package-name validation and returns an error response instead of attempting install.
src/testRunner/unittests/tsserver/codeFix.ts	Adds a unit test to exercise the new validation via applyCodeActionCommand.

[Jake Bailey (jakebailey)]

TypeScript Bot (@typescript-bot) cherry-pick this to release-6.0

[TypeScript Bot (typescript-bot)]

Starting jobs; this comment will be updated as builds start and complete.

Command	Status	Results
cherry-pick this to release-6.0	✅ Started	✅ Results

[TypeScript Bot (typescript-bot)]

Hey, Jake Bailey (@jakebailey)! I've created #63407 for you.