Direct build, App Store, and native companions
Most WebExtensions do not need a desktop helper. Those extensions use the WebExtension APIs implemented by WebKit in either Crest build. A smaller group—password managers are the common example—uses nativeMessaging to connect the extension to a separate Mac app.
Compare the builds
| Build | Ordinary WebExtensions | Native companion helpers |
|---|---|---|
| App Store build | Supported where WebKit implements the required APIs. | Unavailable. The Mac App Sandbox prevents Crest from launching registered companion executables. |
| Crest Direct | Supported at the same WebKit boundary. | Available only to a verified Chrome Web Store installation whose exact extension identity appears in the native host's allowed_origins. |
Crest explains the App Store limitation in plain language instead of allowing an extension to appear functional while its companion connection silently fails.
Why unpacked extensions cannot use native messaging
Load Unpacked… is useful for development and manual testing, but an unpacked package has no verified Chrome Web Store identity. Crest therefore never grants it native-messaging access.
Why a Safari app bundle is not enough
Scan for Apps and Choose App… can discover ordinary Safari Web Extension resources. The app's Safari-native handler, Safari App Extension behavior, and content blockers are not portable to another browser.
When a developer offers a standards-based WebExtension or Chrome Web Store version, use that package in Crest. Loading a Safari extension's UI is not evidence that its desktop-app bridge works.
What Crest Direct validates
Before launching a native host, Crest Direct checks the signed Chrome Web Store identity, resolves a registered host manifest, requires an exact allowed_origins match, and speaks Chrome's little-endian framed JSON protocol. Both one-shot sendNativeMessage calls and persistent connectNative ports are supported.
Availability
Crest Direct is not a public release yet. The native bridge is implemented and regression-tested, but the direct channel still needs Developer ID signing, notarization, Gatekeeper validation, and a production update mechanism before it can be offered for download.
For a measured companion workflow, continue with Set up 1Password in Crest.