diff --git a/editor/templates/index.mst b/editor/templates/index.mst
index b8d0ac0c0..76036b93c 100644
--- a/editor/templates/index.mst
+++ b/editor/templates/index.mst
@@ -36,7 +36,7 @@
 </head>
 <body spellcheck="false">
 <div id="header">
-    <span class="logo">{{#header.url}}<a href="{{.}}">{{/header.url}}{{#header.image}}<img src="{{.}}" title="{{version}}">{{/header.image}} <span>{{ header.title }}</span>{{#header.url}}</a>{{/header.url}}</span>
+    <span class="logo">{{#header.url}}<a href="{{.}}">{{/header.url}}{{#header.image}}<img src="{{.}}">{{/header.image}} <span>{{ header.title }}</span>{{#header.url}}</a>{{/header.url}}</span>
     <ul class="header-toolbar hide">
         <li><a id="btn-sidemenu" class="button" data-toggle="dropdown" href="#"><i class="fa fa-bars"></i></a></li>
     </ul>
diff --git a/red/api/editor/index.js b/red/api/editor/index.js
index 10f3c70b7..a32c16ede 100644
--- a/red/api/editor/index.js
+++ b/red/api/editor/index.js
@@ -51,8 +51,7 @@ module.exports = {
 
             var ui = require("./ui");
 
-            // TODO: ui is passed runtime so it get access runtime.nodes.getNodeIconPath
-            ui.init(runtime);
+            ui.init(runtimeAPI);
 
             var editorApp = express();
             if (settings.requireHttps === true) {
@@ -72,13 +71,13 @@ module.exports = {
             editorApp.get("/icons/:scope/:module/:icon",ui.icon);
 
             var theme = require("./theme");
-            theme.init(settings, runtime.version());
+            theme.init(settings);
             editorApp.use("/theme",theme.app());
             editorApp.use("/",ui.editorResources);
 
             //Projects
             var projects = require("./projects");
-            projects.init(runtime);
+            projects.init(runtimeAPI);
             editorApp.use("/projects",projects.app());
 
             // Locales
@@ -89,7 +88,7 @@ module.exports = {
 
             // Library
             var library = require("./library");
-            library.init(editorApp,runtimeAPI);
+            library.init(runtimeAPI);
 
             editorApp.get("/library/flows",needsPermission("library.read"),library.getAll,apiUtil.errorHandler);
             editorApp.get(/library\/([^\/]+)(?:$|\/(.*))/,needsPermission("library.read"),library.getEntry);
diff --git a/red/api/editor/library.js b/red/api/editor/library.js
index be1b8ee5b..e8b09424a 100644
--- a/red/api/editor/library.js
+++ b/red/api/editor/library.js
@@ -22,7 +22,7 @@ var when = require('when');
 var runtimeAPI;
 
 module.exports = {
-    init: function(app,_runtimeAPI) {
+    init: function(_runtimeAPI) {
         runtimeAPI = _runtimeAPI;
     },
 
diff --git a/red/api/editor/projects/index.js b/red/api/editor/projects/index.js
index 257791b8e..508ca8e10 100644
--- a/red/api/editor/projects/index.js
+++ b/red/api/editor/projects/index.js
@@ -15,89 +15,74 @@
  **/
 
 var express = require("express");
-var runtime;
+var apiUtils = require("../../util");
+
+var runtimeAPI;
 var needsPermission = require("../../auth").needsPermission;
 
 module.exports = {
-    init: function(_runtime) {
-        runtime = _runtime;
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
     },
     app: function() {
         var app = express();
 
         app.use(function(req,res,next) {
-            if (!runtime.storage.projects) {
-                res.status(404).end();
-            } else {
-                next();
-            }
+            runtimeAPI.projects.available().then(function(available) {
+                if (!available) {
+                    res.status(404).end();
+                } else {
+                    next();
+                }
+            })
         });
 
         // Projects
 
         // List all projects
         app.get("/", needsPermission("projects.read"), function(req,res) {
-            runtime.storage.projects.listProjects(req.user, req.user).then(function(list) {
-                var active = runtime.storage.projects.getActiveProject(req.user);
-                var response = {
-                    projects: list
-                };
-                if (active) {
-                    response.active = active.name;
-                }
-                res.json(response);
+            var opts = {
+                user: req.user
+            }
+            runtimeAPI.projects.listProjects(opts).then(function(result) {
+                res.json(result);
             }).catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
-            })
+                apiUtils.rejectHandler(req,res,err);
+            });
         });
 
         // Create project
         app.post("/", needsPermission("projects.write"), function(req,res) {
-            runtime.storage.projects.createProject(req.user, req.body).then(function(data) {
-                res.json(data);
+            var opts = {
+                user: req.user,
+                project: req.body
+            }
+            runtimeAPI.projects.createProject(opts).then(function(result) {
+                res.json(result);
             }).catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
-            })
+                apiUtils.rejectHandler(req,res,err);
+            });
         });
 
         // Update a project
         app.put("/:id", needsPermission("projects.write"), function(req,res) {
-            //TODO: validate the payload properly
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                project: req.body
+            }
+
             if (req.body.active) {
-                var currentProject = runtime.storage.projects.getActiveProject(req.user);
-                if (!currentProject || req.params.id !== currentProject.name) {
-                    runtime.storage.projects.setActiveProject(req.user, req.params.id).then(function() {
-                        res.redirect(303,req.baseUrl + '/');
-                    }).catch(function(err) {
-                        if (err.code) {
-                            res.status(400).json({error:err.code, message: err.message});
-                        } else {
-                            res.status(400).json({error:"unexpected_error", message:err.toString()});
-                        }
-                    })
-                } else {
-                    res.redirect(303,req.baseUrl + '/'+ req.params.id);
-                }
+                runtimeAPI.projects.setActiveProject(opts).then(function() {
+                    res.redirect(303,req.baseUrl + '/');
+                }).catch(function(err) {
+                    apiUtils.rejectHandler(req,res,err);
+                })
             } else if (req.body.initialise) {
-                // Initialised set when creating default files for an empty repo
-                runtime.storage.projects.initialiseProject(req.user, req.params.id, req.body).then(function() {
+                runtimeAPI.projects.initialiseProject(opts).then(function() {
                     res.redirect(303,req.baseUrl + '/'+ req.params.id);
                 }).catch(function(err) {
-                    if (err.code) {
-                        res.status(400).json({error:err.code, message: err.message});
-                    } else {
-                        res.status(400).json({error:"unexpected_error", message:err.toString()});
-                    }
+                    apiUtils.rejectHandler(req,res,err);
                 })
             } else if (req.body.hasOwnProperty('credentialSecret') ||
                        req.body.hasOwnProperty('description') ||
@@ -105,14 +90,10 @@ module.exports = {
                        req.body.hasOwnProperty('summary') ||
                        req.body.hasOwnProperty('files') ||
                         req.body.hasOwnProperty('git')) {
-                runtime.storage.projects.updateProject(req.user, req.params.id, req.body).then(function() {
+                runtimeAPI.projects.updateProject(opts).then(function() {
                     res.redirect(303,req.baseUrl + '/'+ req.params.id);
                 }).catch(function(err) {
-                    if (err.code) {
-                        res.status(400).json({error:err.code, message: err.message});
-                    } else {
-                        res.status(400).json({error:"unexpected_error", message:err.toString()});
-                    }
+                    apiUtils.rejectHandler(req,res,err);
                 })
             } else {
                 res.status(400).json({error:"unexpected_error", message:"invalid_request"});
@@ -121,437 +102,404 @@ module.exports = {
 
         // Get project metadata
         app.get("/:id", needsPermission("projects.read"), function(req,res) {
-            runtime.storage.projects.getProject(req.user, req.params.id).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.getProject(opts).then(function(data) {
                 if (data) {
                     res.json(data);
                 } else {
                     res.status(404).end();
                 }
             }).catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Delete project
         app.delete("/:id", needsPermission("projects.write"), function(req,res) {
-            runtime.storage.projects.deleteProject(req.user, req.params.id).then(function() {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.deleteProject(opts).then(function() {
                 res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()})
-            });
         });
 
 
         // Get project status - files, commit counts, branch info
         app.get("/:id/status", needsPermission("projects.read"), function(req,res) {
-            var includeRemote = req.query.remote;
-
-            runtime.storage.projects.getStatus(req.user, req.params.id, includeRemote).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.query.remote
+            }
+            runtimeAPI.projects.getStatus(opts).then(function(data){
                 if (data) {
                     res.json(data);
                 } else {
                     res.status(404).end();
                 }
             }).catch(function(err) {
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
 
         // Project file listing
         app.get("/:id/files", needsPermission("projects.read"), function(req,res) {
-            runtime.storage.projects.getFiles(req.user, req.params.id).then(function(data) {
-                // console.log("TODO: REMOVE /:id/files as /:id/status is better!")
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.getFiles(opts).then(function(data) {
                 res.json(data);
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
-            .catch(function(err) {
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
-            })
+
         });
 
 
         // Get file content in a given tree (index/stage)
         app.get("/:id/files/:treeish/*", needsPermission("projects.read"), function(req,res) {
-            var projectId = req.params.id;
-            var treeish = req.params.treeish;
-            var filePath = req.params[0];
-
-            runtime.storage.projects.getFile(req.user, projectId,filePath,treeish).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                tree: req.params.treeish
+            }
+            runtimeAPI.projects.getFile(opts).then(function(data) {
                 res.json({content:data});
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Revert a file
         app.delete("/:id/files/_/*", needsPermission("projects.write"), function(req,res) {
-            var projectId = req.params.id;
-            var filePath = req.params[0];
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0]
+            }
 
-            runtime.storage.projects.revertFile(req.user, projectId,filePath).then(function() {
+            runtimeAPI.projects.revertFile(opts).then(function() {
                 res.status(204).end();
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
-
-
         // Stage a file
         app.post("/:id/stage/*", needsPermission("projects.write"), function(req,res) {
-            var projectName = req.params.id;
-            var file = req.params[0];
-
-            runtime.storage.projects.stageFile(req.user, projectName,file).then(function(data) {
-                res.redirect(303,req.baseUrl+"/"+projectName+"/status");
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0]
+            }
+            runtimeAPI.projects.stageFile(opts).then(function() {
+                res.redirect(303,req.baseUrl+"/"+opts.id+"/status");
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Stage multiple files
         app.post("/:id/stage", needsPermission("projects.write"), function(req,res) {
-            var projectName = req.params.id;
-            var files = req.body.files;
-
-            runtime.storage.projects.stageFile(req.user, projectName,files).then(function(data) {
-                res.redirect(303,req.baseUrl+"/"+projectName+"/status");
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.body.files
+            }
+            runtimeAPI.projects.stageFile(opts).then(function() {
+                res.redirect(303,req.baseUrl+"/"+opts.id+"/status");
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Commit changes
         app.post("/:id/commit", needsPermission("projects.write"), function(req,res) {
-            var projectName = req.params.id;
-
-            runtime.storage.projects.commit(req.user, projectName,req.body).then(function(data) {
-                res.redirect(303,req.baseUrl+"/"+projectName+"/status");
-            })
-            .catch(function(err) {
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                message: req.body.message
+            }
+            runtimeAPI.projects.commit(opts).then(function() {
+                res.redirect(303,req.baseUrl+"/"+opts.id+"/status");
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Unstage a file
         app.delete("/:id/stage/*", needsPermission("projects.write"), function(req,res) {
-            var projectName = req.params.id;
-            var file = req.params[0];
-
-            runtime.storage.projects.unstageFile(req.user, projectName,file).then(function(data) {
-                res.redirect(303,req.baseUrl+"/"+projectName+"/status");
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0]
+            }
+            runtimeAPI.projects.unstageFile(opts).then(function() {
+                res.redirect(303,req.baseUrl+"/"+opts.id+"/status");
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Unstage multiple files
         app.delete("/:id/stage", needsPermission("projects.write"), function(req, res) {
-            var projectName = req.params.id;
-            runtime.storage.projects.unstageFile(req.user, projectName).then(function(data) {
-                res.redirect(303,req.baseUrl+"/"+projectName+"/status");
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.unstageFile(opts).then(function() {
+                res.redirect(303,req.baseUrl+"/"+opts.id+"/status");
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Get a file diff
         app.get("/:id/diff/:type/*", needsPermission("projects.read"), function(req,res) {
-            var projectName = req.params.id;
-            var type = req.params.type;
-            var file = req.params[0];
-            runtime.storage.projects.getFileDiff(req.user, projectName,file,type).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                type: req.params.type
+            }
+            runtimeAPI.projects.getFileDiff(opts).then(function(data) {
                 res.json({
                     diff: data
                 })
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Get a list of commits
         app.get("/:id/commits", needsPermission("projects.read"), function(req, res) {
-            var projectName = req.params.id;
-            var options = {
-                limit: req.query.limit||20,
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                limit: req.query.limit || 20,
                 before: req.query.before
-            };
-            runtime.storage.projects.getCommits(req.user, projectName,options).then(function(data) {
+            }
+            runtimeAPI.projects.getCommits(opts).then(function(data) {
                 res.json(data);
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Get an individual commit details
         app.get("/:id/commits/:sha", needsPermission("projects.read"), function(req, res) {
-            var projectName = req.params.id;
-            var sha = req.params.sha;
-
-            runtime.storage.projects.getCommit(req.user, projectName,sha).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                sha: req.params.sha
+            }
+            runtimeAPI.projects.getCommit(opts).then(function(data) {
                 res.json({commit:data});
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                res.status(400).json({error:"unexpected_error", message:err.toString()});
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Push local commits to remote
         app.post("/:id/push/?*", needsPermission("projects.write"), function(req,res) {
-            var projectName = req.params.id;
-            var remoteBranchName = req.params[0]
-            var setRemote = req.query.u;
-            runtime.storage.projects.push(req.user, projectName,remoteBranchName,setRemote).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params[0],
+                track: req.query.u
+            }
+            runtimeAPI.projects.push(opts).then(function(data) {
                 res.status(204).end();
-            })
-            .catch(function(err) {
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Pull remote commits
         app.post("/:id/pull/?*", needsPermission("projects.write"), function(req,res) {
-            var projectName = req.params.id;
-            var remoteBranchName = req.params[0];
-            var setUpstream = req.query.setUpstream;
-            var allowUnrelatedHistories = req.query.allowUnrelatedHistories;
-            runtime.storage.projects.pull(req.user, projectName,remoteBranchName,setUpstream,allowUnrelatedHistories).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params[0],
+                track: req.query.setUpstream,
+                allowUnrelatedHistories: req.query.allowUnrelatedHistories
+            }
+            runtimeAPI.projects.pull(opts).then(function(data) {
                 res.status(204).end();
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Abort an ongoing merge
         app.delete("/:id/merge", needsPermission("projects.write"), function(req, res) {
-            var projectName = req.params.id;
-            runtime.storage.projects.abortMerge(req.user, projectName).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.abortMerge(opts).then(function() {
                 res.status(204).end();
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Resolve a merge
         app.post("/:id/resolve/*", needsPermission("projects.write"), function(req, res) {
-            var projectName = req.params.id;
-            var file = req.params[0];
-            var resolution = req.body.resolutions;
-            runtime.storage.projects.resolveMerge(req.user, projectName,file,resolution).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                path: req.params[0],
+                resolution: req.body.resolutions
+            }
+            runtimeAPI.projects.resolveMerge(opts).then(function() {
                 res.status(204).end();
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Get a list of local branches
         app.get("/:id/branches", needsPermission("projects.read"), function(req, res) {
-            var projectName = req.params.id;
-            runtime.storage.projects.getBranches(req.user, projectName,false).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: false
+            }
+            runtimeAPI.projects.getBranches(opts).then(function(data) {
                 res.json(data);
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Delete a local branch - ?force=true
         app.delete("/:id/branches/:branchName", needsPermission("projects.write"), function(req, res) {
-            var projectName = req.params.id;
-            var branchName = req.params.branchName;
-            var force = !!req.query.force;
-            runtime.storage.projects.deleteBranch(req.user, projectName, branchName, false, force).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.params.branchName,
+                force: !!req.query.force
+            }
+            runtimeAPI.projects.deleteBranch(opts).then(function(data) {
                 res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
-            .catch(function(err) {
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
-            });
         });
 
         // Get a list of remote branches
         app.get("/:id/branches/remote", needsPermission("projects.read"), function(req, res) {
-            var projectName = req.params.id;
-            runtime.storage.projects.getBranches(req.user, projectName,true).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: true
+            }
+            runtimeAPI.projects.getBranches(opts).then(function(data) {
                 res.json(data);
-            })
-            .catch(function(err) {
-                console.log(err);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message, remote: err.remote});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Get branch status - commit counts/ahead/behind
         app.get("/:id/branches/remote/*/status", needsPermission("projects.read"), function(req, res) {
-            var projectName = req.params.id;
-            var branch = req.params[0];
-            runtime.storage.projects.getBranchStatus(req.user, projectName,branch).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.params[0]
+            }
+            runtimeAPI.projects.getBranchStatus(opts).then(function(data) {
                 res.json(data);
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Set the active local branch
         app.post("/:id/branches", needsPermission("projects.write"), function(req, res) {
-            var projectName = req.params.id;
-            var branchName = req.body.name;
-            var isCreate = req.body.create;
-            runtime.storage.projects.setBranch(req.user, projectName,branchName,isCreate).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                branch: req.body.name,
+                create: req.body.create
+            }
+            runtimeAPI.projects.setBranch(opts).then(function(data) {
                 res.json(data);
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Get a list of remotes
         app.get("/:id/remotes", needsPermission("projects.read"), function(req, res) {
-            var projectName = req.params.id;
-            runtime.storage.projects.getRemotes(req.user, projectName).then(function(data) {
+            var opts = {
+                user: req.user,
+                id: req.params.id
+            }
+            runtimeAPI.projects.getRemotes(opts).then(function(data) {
                 res.json(data);
-            })
-            .catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Add a remote
         app.post("/:id/remotes", needsPermission("projects.write"), function(req,res) {
-            var projectName = req.params.id;
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.body
+            }
             if (/^https?:\/\/[^/]+@/i.test(req.body.url)) {
                 res.status(400).json({error:"unexpected_error", message:"Git http url must not include username/password"});
                 return;
             }
-            runtime.storage.projects.addRemote(req.user, projectName, req.body).then(function() {
-                res.redirect(303,req.baseUrl+"/"+projectName+"/remotes");
+            runtimeAPI.projects.addRemote(opts).then(function(data) {
+                res.redirect(303,req.baseUrl+"/"+opts.id+"/remotes");
             }).catch(function(err) {
-                console.log(err.stack);
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
+                apiUtils.rejectHandler(req,res,err);
             })
         });
 
         // Delete a remote
         app.delete("/:id/remotes/:remoteName", needsPermission("projects.write"), function(req, res) {
-            var projectName = req.params.id;
-            var remoteName = req.params.remoteName;
-            runtime.storage.projects.removeRemote(req.user, projectName, remoteName).then(function(data) {
-                res.redirect(303,req.baseUrl+"/"+projectName+"/remotes");
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: req.params.remoteName
+            }
+            runtimeAPI.projects.removeRemote(opts).then(function(data) {
+                res.redirect(303,req.baseUrl+"/"+opts.id+"/remotes");
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
-            .catch(function(err) {
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
-            });
         });
 
         // Update a remote
         app.put("/:id/remotes/:remoteName", needsPermission("projects.write"), function(req,res) {
-            var projectName = req.params.id;
-            var remoteName = req.params.remoteName;
-            runtime.storage.projects.updateRemote(req.user, projectName, remoteName, req.body).then(function(data) {
+            var remote = req.body || {};
+            remote.name = req.params.remoteName;
+            var opts = {
+                user: req.user,
+                id: req.params.id,
+                remote: remote
+            }
+            runtimeAPI.projects.updateRemote(opts).then(function() {
                 res.status(204).end();
+            }).catch(function(err) {
+                apiUtils.rejectHandler(req,res,err);
             })
-            .catch(function(err) {
-                if (err.code) {
-                    res.status(400).json({error:err.code, message: err.message});
-                } else {
-                    res.status(400).json({error:"unexpected_error", message:err.toString()});
-                }
-            });
-
         });
 
         return app;
diff --git a/red/api/editor/theme.js b/red/api/editor/theme.js
index 62e520579..ea088b3eb 100644
--- a/red/api/editor/theme.js
+++ b/red/api/editor/theme.js
@@ -77,11 +77,8 @@ function serveFilesFromTheme(themeValue, themeApp, directory) {
 }
 
 module.exports = {
-    init: function(settings,version) {
+    init: function(settings) {
         themeContext = clone(defaultContext);
-        if (version) {
-            themeContext.version = version;
-        }
         themeSettings = null;
         theme = settings.editorTheme || {};
     },
diff --git a/red/api/editor/ui.js b/red/api/editor/ui.js
index aec8c2fef..36a1a21d1 100644
--- a/red/api/editor/ui.js
+++ b/red/api/editor/ui.js
@@ -17,17 +17,20 @@ var express = require('express');
 var fs = require("fs");
 var path = require("path");
 var Mustache = require("mustache");
+var mime = require("mime");
+
+var apiUtils = require("../util");
 
 var theme = require("./theme");
 
-var redNodes;
+var runtimeAPI;
 
 var templateDir = path.resolve(__dirname+"/../../../editor/templates");
 var editorTemplate;
 
 module.exports = {
-    init: function(runtime) {
-        redNodes = runtime.nodes;
+    init: function(_runtimeAPI) {
+        runtimeAPI = _runtimeAPI;
         editorTemplate = fs.readFileSync(path.join(templateDir,"index.mst"),"utf8");
         Mustache.parse(editorTemplate);
     },
@@ -46,8 +49,18 @@ module.exports = {
         var icon = req.params.icon;
         var scope = req.params.scope;
         var module = scope ? scope + '/' +  req.params.module : req.params.module;
-        var iconPath = redNodes.getNodeIconPath(module,icon);
-        res.sendFile(iconPath);
+        var opts = {
+            user: req.user,
+            module: module,
+            icon: icon
+        }
+        runtimeAPI.nodes.getIcon(opts).then(function(data) {
+            var contentType = mime.lookup(icon);
+            res.set("Content-Type", contentType);
+            res.send(data);
+        }).catch(function(err) {
+            apiUtils.rejectHandler(req,res,err);
+        })
     },
     editor: function(req,res) {
         res.send(Mustache.render(editorTemplate,theme.context()));
diff --git a/red/runtime-api/index.js b/red/runtime-api/index.js
index ab1342953..dbf604a09 100644
--- a/red/runtime-api/index.js
+++ b/red/runtime-api/index.js
@@ -21,44 +21,30 @@
   * @type {object}
   */
 
+var runtime;
 /**
  * @namespace RED
  */
 var api = module.exports = {
-    init: function(runtime, redUtil) {
+    init: function(_runtime, redUtil) {
+        runtime = _runtime;
         api.flows.init(runtime);
         api.nodes.init(runtime);
         api.settings.init(runtime);
         api.library.init(runtime);
+        api.projects.init(runtime);
     },
 
-    /**
-    * Auth module
-    */
     auth: require("./auth"),
-
-    /**
-    * Comms module
-    */
     comms: require("./comms"),
-
-    /**
-    * Flows module
-    */
     flows: require("./flows"),
-
-    /**
-    * Library module
-    */
     library: require("./library"),
-
-    /**
-    * Nodes module
-    */
     nodes: require("./nodes"),
+    settings: require("./settings"),
+    projects: require("./projects"),
 
-    /**
-    * Settings module
-    */
-    settings: require("./settings")
+
+    version: function(opts) {
+        return Promise.resolve(runtime.version());
+    }
 }
diff --git a/red/runtime-api/nodes.js b/red/runtime-api/nodes.js
index 5af0c8a42..7a101c783 100644
--- a/red/runtime-api/nodes.js
+++ b/red/runtime-api/nodes.js
@@ -18,6 +18,8 @@
  * @namespace RED.nodes
  */
 
+var fs = require("fs");
+
 var runtime;
 
 function putNode(node, enabled) {
@@ -371,7 +373,24 @@ var api = module.exports = {
 
     },
     /**
-    * TODO: getIcon
+    * Gets a node icon
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.module - the id of the module requesting the icon
+    * @param {String} opts.icon - the name of the icon
+    * @return {Promise<Buffer>} - the icon file as a Buffer
+    * @memberof RED.nodes
     */
-    getIcon: function() {}
+    getIcon: function(opts) {
+        return new Promise(function(resolve,reject) {
+            var iconPath = runtime.nodes.getNodeIconPath(opts.module,opts.icon);
+            fs.readFile(iconPath,function(err,data) {
+                if (err) {
+                    err.status = 400;
+                    return reject(err);
+                }
+                return resolve(data)
+            });
+        });
+    }
 }
diff --git a/red/runtime-api/projects.js b/red/runtime-api/projects.js
new file mode 100644
index 000000000..849adfd45
--- /dev/null
+++ b/red/runtime-api/projects.js
@@ -0,0 +1,441 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+/**
+ * @namespace RED.projects
+ */
+
+var runtime;
+
+var api = module.exports = {
+    init: function(_runtime) {
+        runtime = _runtime;
+    },
+    available: function(opts) {
+        return Promise.resolve(!!runtime.storage.projects);
+    },
+    /**
+    * List projects known to the runtime
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    listProjects: function(opts) {
+        return runtime.storage.projects.listProjects(opts.user).then(function(list) {
+            var active = runtime.storage.projects.getActiveProject(opts.user);
+            var response = {
+                projects: list
+            };
+            if (active) {
+                response.active = active.name;
+            }
+            return response;
+        }).catch(function(err) {
+            err.status = 400;
+            throw err;
+        })
+    },
+
+
+
+    /**
+    * Create a new project
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {Object} opts.project - the project information
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    createProject: function(opts) {
+        return runtime.storage.projects.createProject(opts.user, opts.project)
+    },
+
+    /**
+    * Initialises an empty project
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project to initialise
+    * @param {Object} opts.project - the project information
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    initialiseProject: function(opts) {
+        // Initialised set when creating default files for an empty repo
+        return runtime.storage.projects.initialiseProject(opts.user, opts.id, opts.project)
+    },
+
+    /**
+    * Gets the active project
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @return {Promise<Object>} - the active project
+    * @memberof RED.projects
+    */
+    getActiveProject: function(opts) {
+        return Promise.resolve(runtime.storage.projects.getActiveProject(opts.user));
+    },
+
+    /**
+    *
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project to activate
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    setActiveProject: function(opts) {
+        var currentProject = runtime.storage.projects.getActiveProject(opts.user);
+        if (!currentProject || opts.id !== currentProject.name) {
+            return runtime.storage.projects.setActiveProject(opts.user, opts.id);
+        } else {
+            return Promise.resolve();
+        }
+    },
+
+    /**
+    * Gets a projects metadata
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project to get
+    * @return {Promise<Object>} - the project metadata
+    * @memberof RED.projects
+    */
+    getProject: function(opts) {
+        return runtime.storage.projects.getProject(opts.user, opts.id)
+    },
+
+    /**
+    * Updates the metadata of an existing project
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project to update
+    * @param {Object} opts.project - the project information
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    updateProject: function(opts) {
+        return runtime.storage.projects.updateProject(opts.user, opts.id, opts.project);
+    },
+
+    /**
+    * Deletes a project
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project to update
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    deleteProject: function(opts) {
+        return runtime.storage.projects.deleteProject(opts.user, opts.id);
+    },
+
+    /**
+    * Gets current git status of a project
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {Boolean} opts.remote - whether to include status of remote repos
+    * @return {Promise<Object>} - the project status
+    * @memberof RED.projects
+    */
+    getStatus: function(opts) {
+        return runtime.storage.projects.getStatus(opts.user, opts.id, opts.remote)
+    },
+
+    /**
+    * Get a list of local branches
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {Boolean} opts.remote - whether to return remote branches (true) or local (false)
+    * @return {Promise<Object>} - a list of the local branches
+    * @memberof RED.projects
+    */
+    getBranches: function(opts) {
+        return runtime.storage.projects.getBranches(opts.user, opts.id, opts.remote);
+    },
+
+    /**
+    * Gets the status of a branch
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.branch - the name of the branch
+    * @return {Promise<Object>} - the status of the branch
+    * @memberof RED.projects
+    */
+    getBranchStatus: function(opts) {
+        return runtime.storage.projects.getBranchStatus(opts.user, opts.id, opts.branch);
+    },
+
+    /**
+    * Sets the current local branch
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.branch - the name of the branch
+    * @param {Boolean} opts.create - whether to create the branch if it doesn't exist
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    setBranch: function(opts) {
+        return runtime.storage.projects.setBranch(opts.user, opts.id, opts.branch, opts.create)
+    },
+
+    /**
+    * Deletes a branch
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.branch - the name of the branch
+    * @param {Boolean} opts.force - whether to force delete
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    deleteBranch: function(opts) {
+        return runtime.storage.projects.deleteBranch(opts.user, opts.id, opts.branch, false, opts.force);
+    },
+
+    /**
+    * Commits the current staged files
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.message - the message to associate with the commit
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    commit: function(opts) {
+        return runtime.storage.projects.commit(opts.user, opts.id,{message: opts.message});
+    },
+
+    /**
+    * Gets the details of a single commit
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.sha - the sha of the commit to return
+    * @return {Promise<Object>} - the commit details
+    * @memberof RED.projects
+    */
+    getCommit: function(opts) {
+        return runtime.storage.projects.getCommit(opts.user, opts.id, opts.sha);
+    },
+
+    /**
+    * Gets the commit history of the project
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.limit - limit how many to return
+    * @param {String} opts.before - id of the commit to work back from
+    * @return {Promise<Array>} - an array of commits
+    * @memberof RED.projects
+    */
+    getCommits: function(opts) {
+        return runtime.storage.projects.getCommits(opts.user, opts.id, {
+            limit: opts.limit || 20,
+            before: opts.before
+        });
+    },
+
+    /**
+    * Abort an in-progress merge
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    abortMerge: function(opts) {
+        return runtime.storage.projects.abortMerge(opts.user, opts.id);
+    },
+
+    /**
+    * Resolves a merge conflict
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.path - the path of the file being merged
+    * @param {String} opts.resolutions - how to resolve the merge conflict
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    resolveMerge: function(opts) {
+        return runtime.storage.projects.resolveMerge(opts.user, opts.id, opts.path, opts.resolution);
+    },
+
+    /**
+    * Gets a listing of the files in the project
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @return {Promise<Object>} - the file listing
+    * @memberof RED.projects
+    */
+    getFiles: function(opts) {
+        return runtime.storage.projects.getFiles(opts.user, opts.id);
+    },
+
+    /**
+    * Gets the contents of a file
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.path - the path of the file
+    * @param {String} opts.tree - the version control tree to use
+    * @return {Promise<String>} - the content of the file
+    * @memberof RED.projects
+    */
+    getFile: function(opts) {
+        return runtime.storage.projects.getFile(opts.user, opts.id,opts.path,opts.tree);
+    },
+
+    /**
+    *
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String|Array} opts.path - the path of the file, or an array of paths
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    stageFile: function(opts) {
+        return runtime.storage.projects.stageFile(opts.user, opts.id, opts.path);
+    },
+
+    /**
+    *
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.path - the path of the file. If not set, all staged files are unstaged
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    unstageFile: function(opts) {
+        return runtime.storage.projects.unstageFile(opts.user, opts.id, opts.path);
+    },
+
+    /**
+    * Reverts changes to a file back to its commited version
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.path - the path of the file
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    revertFile: function(opts) {
+        return runtime.storage.projects.revertFile(opts.user, opts.id,opts.path)
+    },
+
+    /**
+    * Get the diff of a file
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.path - the path of the file
+    * @param {String} opts.type - the type of diff
+    * @return {Promise<Object>} - the requested diff
+    * @memberof RED.projects
+    */
+    getFileDiff: function(opts) {
+        return runtime.storage.projects.getFileDiff(opts.user, opts.id, opts.path, opts.type);
+    },
+
+    /**
+    * Gets a list of the project remotes
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @return {Promise<Object>} - a list of project remotes
+    * @memberof RED.projects
+    */
+    getRemotes: function(opts) {
+        return runtime.storage.projects.getRemotes(opts.user, opts.id);
+
+    },
+
+    /**
+    *
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {Object} opts.remote - the remote metadata
+    * @param {String} opts.remote.name - the name of the remote
+    * @param {String} opts.remote.url - the url of the remote
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    addRemote: function(opts) {
+        return runtime.storage.projects.addRemote(opts.user, opts.id, opts.remote)
+    },
+
+    /**
+    * Remove a project remote
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.remote - the name of the remote
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    removeRemote: function(opts) {
+        return runtime.storage.projects.removeRemote(opts.user, opts.id, opts.remote);
+    },
+
+    /**
+    *
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {Object} opts.remote - the remote metadata
+    * @param {String} opts.remote.name - the name of the remote
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    updateRemote: function(opts) {
+        return runtime.storage.projects.updateRemote(opts.user, opts.id, opts.remote.name, opts.remote)
+    },
+
+    /**
+    * Pull changes from the remote
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    pull: function(opts) {
+        return runtime.storage.projects.pull(opts.user, opts.id, opts.remote, opts.track, opts.allowUnrelatedHistories);
+    },
+
+    /**
+    * Push changes to a remote
+    * @param {Object} opts
+    * @param {User} opts.user - the user calling the api
+    * @param {String} opts.id - the id of the project
+    * @param {String} opts.remote - the name of the remote
+    * @param {String} opts.track - whether to set the remote as the upstream
+    * @return {Promise<Object>} - resolves when complete
+    * @memberof RED.projects
+    */
+    push: function(opts) {
+        return runtime.storage.projects.push(opts.user, opts.id, opts.remote, opts.track);
+    }
+
+}
diff --git a/red/runtime-api/settings.js b/red/runtime-api/settings.js
index e10a6d9c2..716fd7aaf 100644
--- a/red/runtime-api/settings.js
+++ b/red/runtime-api/settings.js
@@ -45,7 +45,7 @@ function extend(target, source) {
     return target;
 }
 
-function getUsername(userObj) {
+function getSSHKeyUsername(userObj) {
     var username = '__default';
     if ( userObj && userObj.name ) {
         username = userObj.name;
@@ -66,48 +66,48 @@ var api = module.exports = {
     getRuntimeSettings: function(opts) {
         return new Promise(function(resolve,reject) {
             try {
-            var safeSettings = {
-                httpNodeRoot: runtime.settings.httpNodeRoot||"/",
-                version: runtime.settings.version,
-                user: opts.user
-            }
+                var safeSettings = {
+                    httpNodeRoot: runtime.settings.httpNodeRoot||"/",
+                    version: runtime.settings.version,
+                    user: opts.user
+                }
 
-            if (util.isArray(runtime.settings.paletteCategories)) {
-                safeSettings.paletteCategories = runtime.settings.paletteCategories;
-            }
+                if (util.isArray(runtime.settings.paletteCategories)) {
+                    safeSettings.paletteCategories = runtime.settings.paletteCategories;
+                }
 
-            if (runtime.settings.flowFilePretty) {
-                safeSettings.flowFilePretty = runtime.settings.flowFilePretty;
-            }
+                if (runtime.settings.flowFilePretty) {
+                    safeSettings.flowFilePretty = runtime.settings.flowFilePretty;
+                }
 
-            if (!runtime.nodes.paletteEditorEnabled()) {
-                safeSettings.editorTheme = safeSettings.editorTheme || {};
-                safeSettings.editorTheme.palette = safeSettings.editorTheme.palette || {};
-                safeSettings.editorTheme.palette.editable = false;
-            }
-            if (runtime.storage.projects) {
-                var activeProject = runtime.storage.projects.getActiveProject();
-                if (activeProject) {
-                    safeSettings.project = activeProject;
-                } else if (runtime.storage.projects.flowFileExists()) {
-                    safeSettings.files = {
-                        flow: runtime.storage.projects.getFlowFilename(),
-                        credentials: runtime.storage.projects.getCredentialsFilename()
+                if (!runtime.nodes.paletteEditorEnabled()) {
+                    safeSettings.editorTheme = safeSettings.editorTheme || {};
+                    safeSettings.editorTheme.palette = safeSettings.editorTheme.palette || {};
+                    safeSettings.editorTheme.palette.editable = false;
+                }
+                if (runtime.storage.projects) {
+                    var activeProject = runtime.storage.projects.getActiveProject();
+                    if (activeProject) {
+                        safeSettings.project = activeProject;
+                    } else if (runtime.storage.projects.flowFileExists()) {
+                        safeSettings.files = {
+                            flow: runtime.storage.projects.getFlowFilename(),
+                            credentials: runtime.storage.projects.getCredentialsFilename()
+                        }
+                    }
+                    safeSettings.git = {
+                        globalUser: runtime.storage.projects.getGlobalGitUser()
                     }
                 }
-                safeSettings.git = {
-                    globalUser: runtime.storage.projects.getGlobalGitUser()
-                }
+
+                safeSettings.flowEncryptionType = runtime.nodes.getCredentialKeyType();
+
+                runtime.settings.exportNodeSettings(safeSettings);
+
+                resolve(safeSettings);
+            }catch(err) {
+                console.log(err);
             }
-
-            safeSettings.flowEncryptionType = runtime.nodes.getCredentialKeyType();
-
-            runtime.settings.exportNodeSettings(safeSettings);
-
-            resolve(safeSettings);
-        }catch(err) {
-            console.log(err);
-        }
         });
     },
 
@@ -173,7 +173,7 @@ var api = module.exports = {
     */
     getUserKeys: function(opts) {
         return new Promise(function(resolve,reject) {
-            var username = getUsername(opts.user);
+            var username = getSSHKeyUsername(opts.user);
             runtime.storage.projects.ssh.listSSHKeys(username).then(function(list) {
                 return resolve(list);
             }).catch(function(err) {
@@ -193,7 +193,7 @@ var api = module.exports = {
     */
     getUserKey: function(opts) {
         return new Promise(function(resolve,reject) {
-            var username = getUsername(opts.user);
+            var username = getSSHKeyUsername(opts.user);
             // console.log('username:', username);
             runtime.storage.projects.ssh.getSSHKey(username, opts.id).then(function(data) {
                 if (data) {
@@ -224,7 +224,7 @@ var api = module.exports = {
     */
     generateUserKey: function(opts) {
         return new Promise(function(resolve,reject) {
-            var username = getUsername(opts.user);
+            var username = getSSHKeyUsername(opts.user);
             runtime.storage.projects.ssh.generateSSHKey(username, opts).then(function(name) {
                 return resolve(name);
             }).catch(function(err) {
@@ -244,7 +244,7 @@ var api = module.exports = {
     */
     removeUserKey: function(opts) {
         return new Promise(function(resolve,reject) {
-            var username = getUsername(req.user);
+            var username = getSSHKeyUsername(req.user);
             runtime.storage.projects.ssh.deleteSSHKey(username, opts.id).then(function() {
                 return resolve();
             }).catch(function(err) {
diff --git a/red/runtime/nodes/registry/registry.js b/red/runtime/nodes/registry/registry.js
index 84f3f8504..4fcd78e18 100644
--- a/red/runtime/nodes/registry/registry.js
+++ b/red/runtime/nodes/registry/registry.js
@@ -615,6 +615,9 @@ function nodeIconDir(dir) {
 }
 
 function getNodeIconPath(module,icon) {
+    if (/\.\./.test(icon)) {
+        throw new Error();
+    }
     var iconName = module+"/"+icon;
     if (iconCache[iconName]) {
         return iconCache[iconName];
