Extra safeguards.

Project manager calls preventDefault() on "links"
background.js rejects messages without a command property.

background.js

@@ -55,7 +55,7 @@ var launch = function(launchData) {
 var onMessage = function(message, sender, sendResponse) {
   //main window will pick up the message, if it's open
   //we also allow extensions to suppress launch behavior for spurious messages
-  if (mainWindow || message.quiet) return;
+  if (mainWindow || message.quiet || !message.command) return;
   commands.push({
     message: message,
     sender: sender,

js/ui/projectManager.js

@@ -226,6 +226,7 @@ define([
     bindEvents: function() {
       var self = this;
       this.element.on("click", function(e) {
+        e.preventDefault();
         var target = e.target;
         if (target.hasClass("directory")) {
           target.parentElement.toggle("expanded");

manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "Caret",
   "description": "Professional text editing for Chrome and Chrome OS",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "manifest_version": 2,
   "icons": {
     "128": "icon-128.png"