How Aqiron Security Split Its VS Code Extension from Its TypeScript Core

Developer building Aqiron Security, an open-source application security tool, chose to separate the security runtime from the VS Code extension as the project grew in complexity. Rather than bundling all logic inside the extension host, the architecture now runs the TypeScript core as a distinct Node.js process that the extension communicates with via stdin/stdout. This process boundary keeps VS Code-specific dependencies out of the security core, allowing the logic to operate on abstract concepts like workspaces rather than VS Code APIs directly. The separation also improves lifecycle management, making it easier to handle long-running scan operations, restarts, and failure isolation. A lightweight request-response protocol with typed message interfaces governs communication between the two layers, with the core package currently bundled privately into the extension rather than published as a standalone npm package.