diff --git a/lib/puppet/face/certificate.rb b/lib/puppet/face/certificate.rb
index 77e80f099..4c2950fb3 100644
--- a/lib/puppet/face/certificate.rb
+++ b/lib/puppet/face/certificate.rb
@@ -1,46 +1,40 @@
 require 'puppet/face/indirector'
 require 'puppet/ssl/host'
 
 Puppet::Face::Indirector.define(:certificate, '0.0.1') do
-  # REVISIT: This should use a pre-invoke hook to run the common code that
-  # needs to happen before we invoke any action; that would be much nicer than
-  # the "please repeat yourself" stuff found in here right now.
-  #
-  # option "--ca-location LOCATION" do
-  #   type [:whatever, :location, :symbols]
-  #   hook :before do |value|
-  #     Puppet::SSL::Host.ca_location = value
-  #   end
-  # end
-  #
-  # ...but should I pass the arguments as well?
-  # --daniel 2011-04-05
-  option "--ca-location LOCATION"
+  option "--ca-location LOCATION" do
+    before_action do |action, args, options|
+      Puppet::SSL::Host.ca_location = options[:ca_location].to_sym
+    end
+  end
 
   action :generate do
+    summary "Generate a new Certificate Signing Request for HOST"
+
     when_invoked do |name, options|
-      Puppet::SSL::Host.ca_location = options[:ca_location].to_sym
       host = Puppet::SSL::Host.new(name)
       host.generate_certificate_request
       host.certificate_request.class.indirection.save(host.certificate_request)
     end
   end
 
   action :list do
+    summary "List all Certificate Signing Requests"
+
     when_invoked do |options|
-      Puppet::SSL::Host.ca_location = options[:ca_location].to_sym
       Puppet::SSL::Host.indirection.search("*", {
         :for => :certificate_request,
       }).map { |h| h.inspect }
     end
   end
 
   action :sign do
+    summary "Sign a Certificate Signing Request for HOST"
+
     when_invoked do |name, options|
-      Puppet::SSL::Host.ca_location = options[:ca_location].to_sym
       host = Puppet::SSL::Host.new(name)
       host.desired_state = 'signed'
       Puppet::SSL::Host.indirection.save(host)
     end
   end
 end
diff --git a/lib/puppet/face/help.rb b/lib/puppet/face/help.rb
index 8bd495f8a..099025583 100644
--- a/lib/puppet/face/help.rb
+++ b/lib/puppet/face/help.rb
@@ -1,105 +1,113 @@
 require 'puppet/face'
 require 'puppet/util/command_line'
 require 'pathname'
 require 'erb'
 
 Puppet::Face.define(:help, '0.0.1') do
   summary "Displays help about puppet subcommands"
 
   action(:help) do
     summary "Display help about faces and their actions."
 
     option "--version VERSION" do
       desc "Which version of the interface to show help for"
     end
 
     default
     when_invoked do |*args|
       # Check our invocation, because we want varargs and can't do defaults
       # yet.  REVISIT: when we do option defaults, and positional options, we
       # should rewrite this to use those. --daniel 2011-04-04
       options = args.pop
       if options.nil? or args.length > 2 then
+        if args.select { |x| x == 'help' } .length > 2 then
+          c = "\n !\"'),-./7:;<GIJLST\\_`abcdefhiklmnoprstuwx|}".split('')
+          i = <<'EOT' .to_i(36)
+2s7ytxy5vpj74kbab5xzf1ik2roinzlefaspjrzckiert5xbaxvwlku3a91w7y1rsdnenp51gwpulmnrp54nwdil36fjgjarab801y0r5a9nh1hdfgi99arn5c5t3zhxbvziu6wx5r1tb7lun7pro69nrxunqqixsh6qmmv0ms0i0yycqw3pystyzmiita0lpxynqsqkbjwadcx82n76wwpzbht8i8rgvqhqick8mk3cs3rvwdjookpgu0rxw4tcezned5sqz5x8z9vntyyz0s4h6hjhtwtbytsmmu7ltvdftaixc7fkt276sqm48ab4yv0ot9y26nz0xniy4pfl1x300lt6h9c8of49vf799ieuxwnoycsjlmtd4qntzit524j0tdn6n5ajmq3z10apjuhkzprvmu53z1gnacymnoforrz5mbqto062kckgw5463pxwzg8liglub4ubnr0dln1s6iy3ummxuhim7m5a7yedl3gyy6ow4qqtmsigv27lysooau24zpsccsvxddwygjprqpbwon7i9s1279m1fpinvva8mfh6bgmotrpxsh1c8rc83l3u0utf5i200yl7ui0ngcbcjyr4erzdee2tqk3fpjvb82t8xhncruhgn7j5dh2m914qzhb0gkoom47k6et7rp4tqjnrv0y2apk5qdl1x1hnbkkxup5ys6ip2ksmtpd3ipmrdtswxr5xwfiqtm60uyjr1v79irhnkrbbt4fwhgqjby1qflgwt9c1wpayzzucep6npgbn3f1k6cn4pug31u02wel4tald4hij8m5p49xr8u4ero1ucs5uht42o8nhpmpe7c7xf9t85i85m9m5kktgoqkgbu52gy5aoteyp8jkm3vri9fnkmwa5h60zt8otja72joxjb40p2rz2vp8f8q9nnggxt3x90pe5u4048ntyuha78q1oikhhpvw9j083yc3l00hz5ehv9c1au5gvctyapzprub289qruve9qsyuh75j04wzkemqw3uhisrfs92u1ahv2qlqxmorgob16c1vbqkxttkoyp2agkt0v5l7lec25p0jqun9y39k41h67aeb5ihiqsftxc9azmg31hc73dk8urlj88vgbmgt8yln9rchw60whgxvnv9zn6cxbr482svctswc5a07atj
+EOT
+          607.times{i,x=i.divmod(1035);a,b=x.divmod(23);print(c[a]*b)}
+          raise ArgumentError, "Such panic is really not required."
+        end
         raise ArgumentError, "help only takes two (optional) arguments, a face name, and an action"
       end
 
       version = :current
       if options.has_key? :version then
         if options[:version].to_s !~ /^current$/i then
           version = options[:version]
         else
           if args.length == 0 then
             raise ArgumentError, "version only makes sense when a face is given"
           end
         end
       end
 
       # Name those parameters...
       facename, actionname = args
 
       if facename then
         if legacy_applications.include? facename then
           actionname and raise ArgumentError, "Legacy subcommands don't take actions"
           return Puppet::Application[facename].help
         else
           face = Puppet::Face[facename.to_sym, version]
           actionname and action = face.get_action(actionname.to_sym)
         end
       end
 
       case args.length
       when 0 then
         template = erb 'global.erb'
       when 1 then
         face or fail ArgumentError, "Unable to load face #{facename}"
         template = erb 'face.erb'
       when 2 then
         face or fail ArgumentError, "Unable to load face #{facename}"
         action or fail ArgumentError, "Unable to load action #{actionname} from #{face}"
         template = erb 'action.erb'
       else
         fail ArgumentError, "Too many arguments to help action"
       end
 
       # Run the ERB template in our current binding, including all the local
       # variables we established just above. --daniel 2011-04-11
       return template.result(binding)
     end
   end
 
   def erb(name)
     template = (Pathname(__FILE__).dirname + "help" + name)
     erb = ERB.new(template.read, nil, '%')
     erb.filename = template.to_s
     return erb
   end
 
   def legacy_applications
     # The list of applications, less those that are duplicated as a face.
     Puppet::Util::CommandLine.available_subcommands.reject do |appname|
       Puppet::Face.face? appname.to_sym, :current or
         # ...this is a nasty way to exclude non-applications. :(
         %w{face_base indirection_base}.include? appname
     end.sort
   end
 
   def horribly_extract_summary_from(appname)
     begin
       require "puppet/application/#{appname}"
       help = Puppet::Application[appname].help.split("\n")
       # Now we find the line with our summary, extract it, and return it.  This
       # depends on the implementation coincidence of how our pages are
       # formatted.  If we can't match the pattern we expect we return the empty
       # string to ensure we don't blow up in the summary. --daniel 2011-04-11
       while line = help.shift do
         if md = /^puppet-#{appname}\([^\)]+\) -- (.*)$/.match(line) then
           return md[1]
         end
       end
     rescue Exception
       # Damn, but I hate this: we just ignore errors here, no matter what
       # class they are.  Meh.
     end
     return ''
   end
 end
diff --git a/lib/puppet/face/indirector.rb b/lib/puppet/face/indirector.rb
index f48611e4b..6c7708b51 100644
--- a/lib/puppet/face/indirector.rb
+++ b/lib/puppet/face/indirector.rb
@@ -1,94 +1,95 @@
 require 'puppet'
 require 'puppet/face'
 
 class Puppet::Face::Indirector < Puppet::Face
   option "--terminus TERMINUS" do
     desc "REVISIT: You can select a terminus, which has some bigger effect
 that we should describe in this file somehow."
+
+    before_action do |action, args, options|
+      set_terminus(options[:terminus])
+    end
+
+    after_action do |action, args, options|
+      indirection.reset_terminus_class
+    end
   end
 
   def self.indirections
     Puppet::Indirector::Indirection.instances.collect { |t| t.to_s }.sort
   end
 
   def self.terminus_classes(indirection)
     Puppet::Indirector::Terminus.terminus_classes(indirection.to_sym).collect { |t| t.to_s }.sort
   end
 
   def call_indirection_method(method, *args)
     options = args.last
-    options.has_key?(:terminus) and set_terminus(options[:terminus])
 
     begin
       result = indirection.__send__(method, *args)
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       raise "Could not call '#{method}' on '#{indirection_name}': #{detail}"
     end
 
-    indirection.reset_terminus_class
     return result
   end
 
   action :destroy do
     when_invoked { |*args| call_indirection_method(:destroy, *args) }
   end
 
   action :find do
     when_invoked { |*args| call_indirection_method(:find, *args) }
   end
 
   action :save do
     when_invoked { |*args| call_indirection_method(:save, *args) }
   end
 
   action :search do
     when_invoked { |*args| call_indirection_method(:search, *args) }
   end
 
   # Print the configuration for the current terminus class
   action :info do
     when_invoked do |*args|
-      options = args.pop
-      options.has_key?(:terminus) and set_terminus(options[:terminus])
-
       if t = indirection.terminus_class
         puts "Run mode '#{Puppet.run_mode.name}': #{t}"
       else
         $stderr.puts "No default terminus class for run mode '#{Puppet.run_mode.name}'"
       end
-
-      indirection.reset_terminus_class
     end
   end
 
   attr_accessor :from
 
   def indirection_name
     @indirection_name || name.to_sym
   end
 
   # Here's your opportunity to override the indirection name.  By default it
   # will be the same name as the face.
   def set_indirection_name(name)
     @indirection_name = name
   end
 
   # Return an indirection associated with a face, if one exists;
   # One usually does.
   def indirection
     unless @indirection
       @indirection = Puppet::Indirector::Indirection.instance(indirection_name)
       @indirection or raise "Could not find terminus for #{indirection_name}"
     end
     @indirection
   end
 
   def set_terminus(from)
     begin
       indirection.terminus_class = from
     rescue => detail
       raise "Could not set '#{indirection.name}' terminus to '#{from}' (#{detail}); valid terminus types are #{self.class.terminus_classes(indirection.name).join(", ") }"
     end
   end
 end
diff --git a/lib/puppet/interface.rb b/lib/puppet/interface.rb
index 6570ebe46..5e9355061 100644
--- a/lib/puppet/interface.rb
+++ b/lib/puppet/interface.rb
@@ -1,120 +1,159 @@
 require 'puppet'
 require 'puppet/util/autoload'
 
 class Puppet::Interface
   require 'puppet/interface/face_collection'
 
   require 'puppet/interface/action_manager'
   include Puppet::Interface::ActionManager
   extend Puppet::Interface::ActionManager
 
   require 'puppet/interface/option_manager'
   include Puppet::Interface::OptionManager
   extend Puppet::Interface::OptionManager
 
   include Puppet::Util
 
   class << self
     # This is just so we can search for actions.  We only use its
     # list of directories to search.
     # Can't we utilize an external autoloader, or simply use the $LOAD_PATH? -pvb
     def autoloader
       @autoloader ||= Puppet::Util::Autoload.new(:application, "puppet/face")
     end
 
     def faces
       Puppet::Interface::FaceCollection.faces
     end
 
     def face?(name, version)
       Puppet::Interface::FaceCollection.face?(name, version)
     end
 
     def register(instance)
       Puppet::Interface::FaceCollection.register(instance)
     end
 
     def define(name, version, &block)
       if face?(name, version)
         face = Puppet::Interface::FaceCollection[name, version]
       else
         face = self.new(name, version)
         Puppet::Interface::FaceCollection.register(face)
         # REVISIT: Shouldn't this be delayed until *after* we evaluate the
         # current block, not done before? --daniel 2011-04-07
         face.load_actions
       end
 
       face.instance_eval(&block) if block_given?
 
       return face
     end
 
     def [](name, version)
       unless face = Puppet::Interface::FaceCollection[name, version]
         if current = Puppet::Interface::FaceCollection[name, :current]
           raise Puppet::Error, "Could not find version #{version} of #{current}"
         else
           raise Puppet::Error, "Could not find Puppet Face #{name.inspect}"
         end
       end
       face
     end
   end
 
   attr_accessor :default_format
 
   def set_default_format(format)
     self.default_format = format.to_sym
   end
 
   attr_accessor :summary
   def summary(value = nil)
     @summary = value unless value.nil?
     @summary
   end
 
   attr_reader :name, :version
 
   def initialize(name, version, &block)
     unless Puppet::Interface::FaceCollection.validate_version(version)
       raise ArgumentError, "Cannot create face #{name.inspect} with invalid version number '#{version}'!"
     end
 
     @name = Puppet::Interface::FaceCollection.underscorize(name)
     @version = version
     @default_format = :pson
 
     instance_eval(&block) if block_given?
   end
 
   # Try to find actions defined in other files.
   def load_actions
     path = "puppet/face/#{name}"
 
     loaded = []
     [path, "#{name}@#{version}/#{path}"].each do |path|
       Puppet::Interface.autoloader.search_directories.each do |dir|
         fdir = ::File.join(dir, path)
         next unless FileTest.directory?(fdir)
 
         Dir.chdir(fdir) do
           Dir.glob("*.rb").each do |file|
             aname = file.sub(/\.rb/, '')
             if loaded.include?(aname)
               Puppet.debug "Not loading duplicate action '#{aname}' for '#{name}' from '#{fdir}/#{file}'"
               next
             end
             loaded << aname
             Puppet.debug "Loading action '#{aname}' for '#{name}' from '#{fdir}/#{file}'"
             require "#{Dir.pwd}/#{aname}"
           end
         end
       end
     end
   end
 
   def to_s
     "Puppet::Face[#{name.inspect}, #{version.inspect}]"
   end
+
+  ########################################################################
+  # Action decoration, whee!  You are not expected to care about this code,
+  # which exists to support face building and construction.  I marked these
+  # private because the implementation is crude and ugly, and I don't yet know
+  # enough to work out how to make it clean.
+  #
+  # Once we have established that these methods will likely change radically,
+  # to be unrecognizable in the final outcome.  At which point we will throw
+  # all this away, replace it with something nice, and work out if we should
+  # be making this visible to the outside world... --daniel 2011-04-14
+  private
+  def __invoke_decorations(type, action, passed_args = [], passed_options = {})
+    [:before, :after].member?(type) or fail "unknown decoration type #{type}"
+
+    # Collect the decoration methods matching our pass.
+    methods = action.options.select do |name|
+      passed_options.has_key? name
+    end.map do |name|
+      action.get_option(name).__decoration_name(type)
+    end
+
+    methods.each do |hook|
+      begin
+        respond_to? hook and self.__send__(hook, action, passed_args, passed_options)
+      rescue => e
+        Puppet.warning("invoking #{action} #{type} hook: #{e}")
+      end
+    end
+  end
+
+  def __decorate(type, name, proc)
+    meta_def(name, &proc)
+    method(name).unbind
+  end
+  def self.__decorate(type, name, proc)
+    define_method(name, proc)
+    instance_method(name)
+  end
 end
diff --git a/lib/puppet/interface/action.rb b/lib/puppet/interface/action.rb
index 3c18c2aaf..b94298963 100644
--- a/lib/puppet/interface/action.rb
+++ b/lib/puppet/interface/action.rb
@@ -1,129 +1,152 @@
 # -*- coding: utf-8 -*-
 require 'puppet/interface'
 require 'puppet/interface/option'
 
 class Puppet::Interface::Action
   def initialize(face, name, attrs = {})
     raise "#{name.inspect} is an invalid action name" unless name.to_s =~ /^[a-z]\w*$/
     @face    = face
     @name    = name.to_sym
-    @options = {}
     attrs.each do |k, v| send("#{k}=", v) end
+
+    @options = {}
   end
 
   # This is not nice, but it is the easiest way to make us behave like the
   # Ruby Method object rather than UnboundMethod.  Duplication is vaguely
   # annoying, but at least we are a shallow clone. --daniel 2011-04-12
   def __dup_and_rebind_to(to)
     bound_version = self.dup
     bound_version.instance_variable_set(:@face, to)
     return bound_version
   end
 
   attr_reader :name
   def to_s() "#{@face}##{@name}" end
 
   attr_accessor :default, :summary
 
   # Initially, this was defined to allow the @action.invoke pattern, which is
   # a very natural way to invoke behaviour given our introspection
   # capabilities.   Heck, our initial plan was to have the faces delegate to
   # the action object for invocation and all.
   #
   # It turns out that we have a binding problem to solve: @face was bound to
   # the parent class, not the subclass instance, and we don't pass the
   # appropriate context or change the binding enough to make this work.
   #
   # We could hack around it, by either mandating that you pass the context in
   # to invoke, or try to get the binding right, but that has probably got
   # subtleties that we don't instantly think of – especially around threads.
   #
   # So, we are pulling this method for now, and will return it to life when we
   # have the time to resolve the problem.  For now, you should replace...
   #
   #     @action = @face.get_action(name)
   #     @action.invoke(arg1, arg2, arg3)
   #
   # ...with...
   #
   #     @action = @face.get_action(name)
   #     @face.send(@action.name, arg1, arg2, arg3)
   #
   # I understand that is somewhat cumbersome, but it functions as desired.
   # --daniel 2011-03-31
   #
   # PS: This code is left present, but commented, to support this chunk of
   # documentation, for the benefit of the reader.
   #
   # def invoke(*args, &block)
   #   @face.send(name, *args, &block)
   # end
 
   def when_invoked=(block)
     # We need to build an instance method as a wrapper, using normal code, to
     # be able to expose argument defaulting between the caller and definer in
     # the Ruby API.  An extra method is, sadly, required for Ruby 1.8 to work.
     #
     # In future this also gives us a place to hook in additional behaviour
     # such as calling out to the action instance to validate and coerce
     # parameters, which avoids any exciting context switching and all.
     #
     # Hopefully we can improve this when we finally shuffle off the last of
     # Ruby 1.8 support, but that looks to be a few "enterprise" release eras
     # away, so we are pretty stuck with this for now.
     #
     # Patches to make this work more nicely with Ruby 1.9 using runtime
     # version checking and all are welcome, but they can't actually help if
     # the results are not totally hidden away in here.
     #
     # Incidentally, we though about vendoring evil-ruby and actually adjusting
     # the internal C structure implementation details under the hood to make
     # this stuff work, because it would have been cleaner.  Which gives you an
     # idea how motivated we were to make this cleaner.  Sorry. --daniel 2011-03-31
 
     internal_name = "#{@name} implementation, required on Ruby 1.8".to_sym
     file = __FILE__ + "+eval"
     line = __LINE__ + 1
-    wrapper = "def #{@name}(*args, &block)
-                 args << {} unless args.last.is_a? Hash
-                 args << block if block_given?
-                 self.__send__(#{internal_name.inspect}, *args)
-               end"
+    wrapper = <<WRAPPER
+def #{@name}(*args, &block)
+  if args.last.is_a? Hash then
+    options = args.last
+  else
+    args << (options = {})
+  end
+
+  action = get_action(#{name.inspect})
+  __invoke_decorations(:before, action, args, options)
+  rval = self.__send__(#{internal_name.inspect}, *args)
+  __invoke_decorations(:after, action, args, options)
+  return rval
+end
+WRAPPER
 
     if @face.is_a?(Class)
       @face.class_eval do eval wrapper, nil, file, line end
       @face.define_method(internal_name, &block)
     else
       @face.instance_eval do eval wrapper, nil, file, line end
       @face.meta_def(internal_name, &block)
     end
   end
 
   def add_option(option)
     option.aliases.each do |name|
       if conflict = get_option(name) then
         raise ArgumentError, "Option #{option} conflicts with existing option #{conflict}"
       elsif conflict = @face.get_option(name) then
         raise ArgumentError, "Option #{option} conflicts with existing option #{conflict} on #{@face}"
       end
     end
 
     option.aliases.each do |name|
       @options[name] = option
     end
 
     option
   end
 
   def option?(name)
     @options.include? name.to_sym
   end
 
   def options
     (@options.keys + @face.options).sort
   end
 
-  def get_option(name)
-    @options[name.to_sym] || @face.get_option(name)
+  def get_option(name, with_inherited_options = true)
+    option = @options[name.to_sym]
+    if option.nil? and with_inherited_options
+      option = @face.get_option(name)
+    end
+    option
+  end
+
+  ########################################################################
+  # Support code for action decoration; see puppet/interface.rb for the gory
+  # details of why this is hidden away behind private. --daniel 2011-04-15
+  private
+  def __decorate(type, name, proc)
+    @face.__send__ :__decorate, type, name, proc
   end
 end
diff --git a/lib/puppet/interface/option.rb b/lib/puppet/interface/option.rb
index ccc2fbba7..2abcd4033 100644
--- a/lib/puppet/interface/option.rb
+++ b/lib/puppet/interface/option.rb
@@ -1,82 +1,103 @@
 require 'puppet/interface'
 
 class Puppet::Interface::Option
-  attr_reader   :parent
-  attr_reader   :name
-  attr_reader   :aliases
-  attr_reader   :optparse
-  attr_accessor :desc
-
-  def takes_argument?
-    !!@argument
-  end
-  def optional_argument?
-    !!@optional_argument
-  end
-
   def initialize(parent, *declaration, &block)
     @parent   = parent
     @optparse = []
 
     # Collect and sort the arguments in the declaration.
     dups = {}
     declaration.each do |item|
       if item.is_a? String and item.to_s =~ /^-/ then
         unless item =~ /^-[a-z]\b/ or item =~ /^--[^-]/ then
           raise ArgumentError, "#{item.inspect}: long options need two dashes (--)"
         end
         @optparse << item
 
         # Duplicate checking...
         name = optparse_to_name(item)
         if dup = dups[name] then
           raise ArgumentError, "#{item.inspect}: duplicates existing alias #{dup.inspect} in #{@parent}"
         else
           dups[name] = item
         end
       else
         raise ArgumentError, "#{item.inspect} is not valid for an option argument"
       end
     end
 
     if @optparse.empty? then
       raise ArgumentError, "No option declarations found while building"
     end
 
     # Now, infer the name from the options; we prefer the first long option as
     # the name, rather than just the first option.
     @name = optparse_to_name(@optparse.find do |a| a =~ /^--/ end || @optparse.first)
     @aliases = @optparse.map { |o| optparse_to_name(o) }
 
     # Do we take an argument?  If so, are we consistent about it, because
     # incoherence here makes our life super-difficult, and we can more easily
     # relax this rule later if we find a valid use case for it. --daniel 2011-03-30
     @argument = @optparse.any? { |o| o =~ /[ =]/ }
     if @argument and not @optparse.all? { |o| o =~ /[ =]/ } then
       raise ArgumentError, "Option #{@name} is inconsistent about taking an argument"
     end
 
     # Is our argument optional?  The rules about consistency apply here, also,
     # just like they do to taking arguments at all. --daniel 2011-03-30
     @optional_argument = @optparse.any? { |o| o.include? "[" }
     if @optional_argument and not @optparse.all? { |o| o.include? "[" } then
       raise ArgumentError, "Option #{@name} is inconsistent about the argument being optional"
     end
   end
 
   # to_s and optparse_to_name are roughly mirrored, because they are used to
   # transform options to name symbols, and vice-versa.  This isn't a full
   # bidirectional transformation though. --daniel 2011-04-07
   def to_s
     @name.to_s.tr('_', '-')
   end
 
   def optparse_to_name(declaration)
     unless found = declaration.match(/^-+(?:\[no-\])?([^ =]+)/) then
       raise ArgumentError, "Can't find a name in the declaration #{declaration.inspect}"
     end
     name = found.captures.first.tr('-', '_')
     raise "#{name.inspect} is an invalid option name" unless name.to_s =~ /^[a-z]\w*$/
     name.to_sym
   end
+
+
+  def takes_argument?
+    !!@argument
+  end
+  def optional_argument?
+    !!@optional_argument
+  end
+
+
+  attr_reader   :parent, :name, :aliases, :optparse
+  attr_accessor :desc
+
+  attr_accessor :before_action
+  def before_action=(proc)
+    proc.is_a? Proc or raise ArgumentError, "before action hook for #{self} is a #{proc.class.name.inspect}, not a proc"
+    @before_action =
+      @parent.__send__(:__decorate, :before, __decoration_name(:before), proc)
+  end
+
+  attr_accessor :after_action
+  def after_action=(proc)
+    proc.is_a? Proc or raise ArgumentError, "after action hook for #{self} is a #{proc.class.name.inspect}, not a proc"
+    @after_action =
+      @parent.__send__(:__decorate, :after, __decoration_name(:after), proc)
+  end
+
+  def __decoration_name(type)
+    if @parent.is_a? Puppet::Interface::Action then
+      :"option #{name} from #{parent.name} #{type} decoration"
+    else
+      :"option #{name} #{type} decoration"
+    end
+  end
 end
diff --git a/lib/puppet/interface/option_builder.rb b/lib/puppet/interface/option_builder.rb
index 2240b3e4a..d4e59a4df 100644
--- a/lib/puppet/interface/option_builder.rb
+++ b/lib/puppet/interface/option_builder.rb
@@ -1,25 +1,50 @@
 require 'puppet/interface/option'
 
 class Puppet::Interface::OptionBuilder
   attr_reader :option
 
   def self.build(face, *declaration, &block)
     new(face, *declaration, &block).option
   end
 
   private
   def initialize(face, *declaration, &block)
     @face   = face
     @option = Puppet::Interface::Option.new(face, *declaration)
     block and instance_eval(&block)
     @option
   end
 
   # Metaprogram the simple DSL from the option class.
   Puppet::Interface::Option.instance_methods.grep(/=$/).each do |setter|
-    next if setter =~ /^=/      # special case, darn it...
+    next if setter =~ /^=/
+    dsl = setter.sub(/=$/, '')
 
-    dsl = setter.to_s.sub(/=$/, '')
-    define_method(dsl) do |value| @option.send(setter, value) end
+    unless self.class.methods.include?(dsl)
+      define_method(dsl) do |value| @option.send(setter, value) end
+    end
+  end
+
+  # Override some methods that deal in blocks, not objects.
+  def before_action(&block)
+    block or raise ArgumentError, "#{@option} before_action requires a block"
+    if @option.before_action
+      raise ArgumentError, "#{@option} already has a before_action set"
+    end
+    unless block.arity == 3 then
+      raise ArgumentError, "before_action takes three arguments, action, args, and options"
+    end
+    @option.before_action = block
+  end
+
+  def after_action(&block)
+    block or raise ArgumentError, "#{@option} after_action requires a block"
+    if @option.after_action
+      raise ArgumentError, "#{@option} already has a after_action set"
+    end
+    unless block.arity == 3 then
+      raise ArgumentError, "after_action takes three arguments, action, args, and options"
+    end
+    @option.after_action = block
   end
 end
diff --git a/lib/puppet/interface/option_manager.rb b/lib/puppet/interface/option_manager.rb
index 56df9760f..d42359c07 100644
--- a/lib/puppet/interface/option_manager.rb
+++ b/lib/puppet/interface/option_manager.rb
@@ -1,56 +1,56 @@
 require 'puppet/interface/option_builder'
 
 module Puppet::Interface::OptionManager
   # Declare that this app can take a specific option, and provide
   # the code to do so.
   def option(*declaration, &block)
     add_option Puppet::Interface::OptionBuilder.build(self, *declaration, &block)
   end
 
   def add_option(option)
     option.aliases.each do |name|
       if conflict = get_option(name) then
         raise ArgumentError, "Option #{option} conflicts with existing option #{conflict}"
       end
 
       actions.each do |action|
         action = get_action(action)
         if conflict = action.get_option(name) then
           raise ArgumentError, "Option #{option} conflicts with existing option #{conflict} on #{action}"
         end
       end
     end
 
     option.aliases.each { |name| @options[name] = option }
     option
   end
 
   def options
     @options ||= {}
     result = @options.keys
 
     if self.is_a?(Class) and superclass.respond_to?(:options)
       result += superclass.options
     elsif self.class.respond_to?(:options)
       result += self.class.options
     end
     result.sort
   end
 
-  def get_option(name)
+  def get_option(name, with_inherited_options = true)
     @options ||= {}
     result = @options[name.to_sym]
-    unless result then
+    if result.nil? and with_inherited_options then
       if self.is_a?(Class) and superclass.respond_to?(:get_option)
         result = superclass.get_option(name)
       elsif self.class.respond_to?(:get_option)
         result = self.class.get_option(name)
       end
     end
     return result
   end
 
   def option?(name)
     options.include? name.to_sym
   end
 end
diff --git a/spec/lib/puppet/face/basetest.rb b/spec/lib/puppet/face/basetest.rb
index 00616f74f..e935161ae 100755
--- a/spec/lib/puppet/face/basetest.rb
+++ b/spec/lib/puppet/face/basetest.rb
@@ -1 +1,2 @@
+require 'puppet/face'
 Puppet::Face.define(:basetest, '0.0.1')
diff --git a/spec/unit/application/indirection_base_spec.rb b/spec/unit/application/indirection_base_spec.rb
index 63ab11eed..57740384a 100755
--- a/spec/unit/application/indirection_base_spec.rb
+++ b/spec/unit/application/indirection_base_spec.rb
@@ -1,38 +1,37 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/application/indirection_base'
 require 'puppet/face/indirector'
 
 ########################################################################
 # Stub for testing; the names are critical, sadly. --daniel 2011-03-30
 class Puppet::Application::TestIndirection < Puppet::Application::IndirectionBase
 end
 
 face = Puppet::Face::Indirector.define(:testindirection, '0.0.1') do
 end
 # REVISIT: This horror is required because we don't allow anything to be
 # :current except for if it lives on, and is loaded from, disk. --daniel 2011-03-29
 face.instance_variable_set('@version', :current)
 Puppet::Face.register(face)
 ########################################################################
 
 
 describe Puppet::Application::IndirectionBase do
   subject { Puppet::Application::TestIndirection.new }
 
   it "should accept a terminus command line option" do
     # It would be nice not to have to stub this, but whatever... writing an
     # entire indirection stack would cause us more grief. --daniel 2011-03-31
-    terminus = mock("test indirection terminus")
+    terminus = stub_everything("test indirection terminus")
     Puppet::Indirector::Indirection.expects(:instance).
-      with(:testindirection).twice.returns()
+      with(:testindirection).returns(terminus)
 
-    subject.command_line.
-      instance_variable_set('@args', %w{--terminus foo save})
+    subject.command_line.instance_variable_set('@args', %w{--terminus foo save})
 
     # Not a very nice thing. :(
     $stderr.stubs(:puts)
 
     expect { subject.run }.should raise_error SystemExit
   end
 end
diff --git a/spec/unit/face/certificate_spec.rb b/spec/unit/face/certificate_spec.rb
index dbcc888ad..b0bbf1af6 100755
--- a/spec/unit/face/certificate_spec.rb
+++ b/spec/unit/face/certificate_spec.rb
@@ -1,14 +1,19 @@
 require 'puppet/ssl/host'
 
 describe Puppet::Face[:certificate, '0.0.1'] do
   it "should have a ca-location option" do
     subject.should be_option :ca_location
   end
 
   it "should set the ca location when invoked" do
-    pending "#6983: This is broken in the actual face..."
     Puppet::SSL::Host.expects(:ca_location=).with(:foo)
     Puppet::SSL::Host.indirection.expects(:save)
-    subject.sign :ca_location => :foo
+    subject.sign "hello, friend", :ca_location => :foo
+  end
+
+  it "(#7059) should set the ca location when an inherited action is invoked" do
+    Puppet::SSL::Host.expects(:ca_location=).with(:foo)
+    subject.indirection.expects(:find)
+    subject.find "hello, friend", :ca_location => :foo
   end
 end
diff --git a/spec/unit/face/help_spec.rb b/spec/unit/face/help_spec.rb
index e67f29e07..b5205afd6 100755
--- a/spec/unit/face/help_spec.rb
+++ b/spec/unit/face/help_spec.rb
@@ -1,112 +1,116 @@
 require 'spec_helper'
 require 'puppet/face/help'
 
 describe Puppet::Face[:help, '0.0.1'] do
   it "should have a help action" do
     subject.should be_action :help
   end
 
   it "should have a default action of help" do
     pending "REVISIT: we don't support default actions yet"
   end
 
   it "should accept a call with no arguments" do
     expect { subject.help() }.should_not raise_error
   end
 
   it "should accept a face name" do
     expect { subject.help(:help) }.should_not raise_error
   end
 
   it "should accept a face and action name" do
     expect { subject.help(:help, :help) }.should_not raise_error
   end
 
   it "should fail if more than a face and action are given" do
     expect { subject.help(:help, :help, :for_the_love_of_god) }.
       should raise_error ArgumentError
   end
 
   it "should treat :current and 'current' identically" do
     subject.help(:help, :version => :current).should ==
       subject.help(:help, :version => 'current')
   end
 
   it "should complain when the request version of a face is missing" do
     expect { subject.help(:huzzah, :bar, :version => '17.0.0') }.
       should raise_error Puppet::Error
   end
 
   it "should find a face by version" do
     face = Puppet::Face[:huzzah, :current]
     subject.help(:huzzah, :version => face.version).
       should == subject.help(:huzzah, :version => :current)
   end
 
   context "when listing subcommands" do
     subject { Puppet::Face[:help, :current].help }
 
     # Check a precondition for the next block; if this fails you have
     # something odd in your set of face, and we skip testing things that
     # matter. --daniel 2011-04-10
     it "should have at least one face with a summary" do
       Puppet::Face.faces.should be_any do |name|
         Puppet::Face[name, :current].summary
       end
     end
 
-    Puppet::Face.faces.each do |name|
-      face = Puppet::Face[name, :current]
-      summary = face.summary
+    it "should list all faces" do
+      Puppet::Face.faces.each do |name|
+        face = Puppet::Face[name, :current]
+        summary = face.summary
 
-      it { should =~ %r{ #{name} } }
-      it { should =~ %r{ #{name} +#{summary}} } if summary
+        subject.should =~ %r{ #{name} }
+        summary and subject.should =~ %r{ #{name} +#{summary}}
+      end
     end
 
-    Puppet::Face[:help, :current].legacy_applications.each do |appname|
-      it { should =~ %r{ #{appname} } }
+    it "should list all legacy applications" do
+      Puppet::Face[:help, :current].legacy_applications.each do |appname|
+        subject.should =~ %r{ #{appname} }
 
-      summary = Puppet::Face[:help, :current].horribly_extract_summary_from(appname)
-      summary and it { should =~ %r{ #{summary}\b} }
+        summary = Puppet::Face[:help, :current].horribly_extract_summary_from(appname)
+        summary and subject.should =~ %r{ #{summary}\b}
+      end
     end
   end
 
   context "#legacy_applications" do
     subject { Puppet::Face[:help, :current].legacy_applications }
 
     # If we don't, these tests are ... less than useful, because they assume
     # it.  When this breaks you should consider ditching the entire feature
     # and tests, but if not work out how to fake one. --daniel 2011-04-11
     it { should have_at_least(1).item }
 
     # Meh.  This is nasty, but we can't control the other list; the specific
     # bug that caused these to be listed is annoyingly subtle and has a nasty
     # fix, so better to have a "fail if you do something daft" trigger in
     # place here, I think. --daniel 2011-04-11
     %w{face_base indirection_base}.each do |name|
       it { should_not include name }
     end
   end
 
   context "help for legacy applications" do
     subject { Puppet::Face[:help, :current] }
     let :appname do subject.legacy_applications.first end
 
     # This test is purposely generic, so that as we eliminate legacy commands
     # we don't get into a loop where we either test a face-based replacement
     # and fail to notice breakage, or where we have to constantly rewrite this
     # test and all. --daniel 2011-04-11
     it "should return the legacy help when given the subcommand" do
       help = subject.help(appname)
       help.should =~ /puppet-#{appname}/
       %w{SYNOPSIS USAGE DESCRIPTION OPTIONS COPYRIGHT}.each do |heading|
         help.should =~ /^#{heading}$/
       end
     end
 
     it "should fail when asked for an action on a legacy command" do
       expect { subject.help(appname, :whatever) }.
         to raise_error ArgumentError, /Legacy subcommands don't take actions/
     end
   end
 end
diff --git a/spec/unit/interface/action_builder_spec.rb b/spec/unit/interface/action_builder_spec.rb
index 8f29c8a7b..aecaf198f 100755
--- a/spec/unit/interface/action_builder_spec.rb
+++ b/spec/unit/interface/action_builder_spec.rb
@@ -1,80 +1,81 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/interface/action_builder'
 
 describe Puppet::Interface::ActionBuilder do
   describe "::build" do
     it "should build an action" do
       action = Puppet::Interface::ActionBuilder.build(nil, :foo) do
       end
       action.should be_a(Puppet::Interface::Action)
       action.name.should == :foo
     end
 
     it "should define a method on the face which invokes the action" do
-      face = Puppet::Interface.new(:action_builder_test_interface, '0.0.1')
-      action = Puppet::Interface::ActionBuilder.build(face, :foo) do
-        when_invoked do
-          "invoked the method"
+      face = Puppet::Interface.new(:action_builder_test_interface, '0.0.1') do
+        action :foo do
+          when_invoked do
+            "invoked the method"
+          end
         end
       end
 
       face.foo.should == "invoked the method"
     end
 
     it "should require a block" do
       expect { Puppet::Interface::ActionBuilder.build(nil, :foo) }.
         should raise_error("Action :foo must specify a block")
     end
 
     describe "when handling options" do
       let :face do Puppet::Interface.new(:option_handling, '0.0.1') end
 
       it "should have a #option DSL function" do
         method = nil
         Puppet::Interface::ActionBuilder.build(face, :foo) do
           method = self.method(:option)
         end
         method.should be
       end
 
       it "should define an option without a block" do
         action = Puppet::Interface::ActionBuilder.build(face, :foo) do
           option "--bar"
         end
         action.should be_option :bar
       end
 
       it "should accept an empty block" do
         action = Puppet::Interface::ActionBuilder.build(face, :foo) do
           option "--bar" do
             # This space left deliberately blank.
           end
         end
         action.should be_option :bar
       end
     end
 
     context "inline documentation" do
       let :face do Puppet::Interface.new(:inline_action_docs, '0.0.1') end
 
       it "should set the summary" do
         action = Puppet::Interface::ActionBuilder.build(face, :foo) do
           summary "this is some text"
         end
         action.summary.should == "this is some text"
       end
     end
 
     context "action defaulting" do
       let :face do Puppet::Interface.new(:default_action, '0.0.1') end
 
       it "should set the default to true" do
         action = Puppet::Interface::ActionBuilder.build(face, :foo) do
           default
         end
         action.default.should == true
       end
     end
   end
 end
diff --git a/spec/unit/interface/action_manager_spec.rb b/spec/unit/interface/action_manager_spec.rb
index 387faa043..6a6c254d4 100755
--- a/spec/unit/interface/action_manager_spec.rb
+++ b/spec/unit/interface/action_manager_spec.rb
@@ -1,250 +1,251 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 # This is entirely an internal class for Interface, so we have to load it instead of our class.
 require 'puppet/interface'
 require 'puppet/face'
 
 class ActionManagerTester
   include Puppet::Interface::ActionManager
 end
 
 describe Puppet::Interface::ActionManager do
   subject { ActionManagerTester.new }
 
   describe "when included in a class" do
     it "should be able to define an action" do
       subject.action(:foo) do
         when_invoked { "something "}
       end
     end
 
     it "should be able to define a 'script' style action" do
       subject.script :bar do
         "a bar is where beer is found"
       end
     end
 
     it "should be able to list defined actions" do
       subject.action(:foo) do
         when_invoked { "something" }
       end
       subject.action(:bar) do
         when_invoked { "something" }
       end
 
       subject.actions.should =~ [:foo, :bar]
     end
 
     it "should list 'script' actions" do
       subject.script :foo do "foo" end
       subject.actions.should =~ [:foo]
     end
 
     it "should list both script and normal actions" do
       subject.action :foo do
         when_invoked do "foo" end
       end
       subject.script :bar do "a bar is where beer is found" end
 
       subject.actions.should =~ [:foo, :bar]
     end
 
     it "should be able to indicate when an action is defined" do
       subject.action(:foo) do
         when_invoked { "something" }
       end
 
       subject.should be_action(:foo)
     end
 
     it "should indicate an action is defined for script actions" do
       subject.script :foo do "foo" end
       subject.should be_action :foo
     end
 
     it "should correctly treat action names specified as strings" do
       subject.action(:foo) do
         when_invoked { "something" }
       end
 
       subject.should be_action("foo")
     end
   end
 
   describe "when used to extend a class" do
     subject { Class.new.extend(Puppet::Interface::ActionManager) }
 
     it "should be able to define an action" do
       subject.action(:foo) do
         when_invoked { "something "}
       end
     end
 
     it "should be able to list defined actions" do
       subject.action(:foo) do
         when_invoked { "something" }
       end
       subject.action(:bar) do
         when_invoked { "something" }
       end
 
       subject.actions.should include(:bar)
       subject.actions.should include(:foo)
     end
 
     it "should be able to indicate when an action is defined" do
       subject.action(:foo) { "something" }
       subject.should be_action(:foo)
     end
   end
 
   describe "when used both at the class and instance level" do
     before do
       @klass = Class.new do
         include Puppet::Interface::ActionManager
         extend Puppet::Interface::ActionManager
+        def __invoke_decorations(*args) true end
       end
       @instance = @klass.new
     end
 
     it "should be able to define an action at the class level" do
       @klass.action(:foo) do
         when_invoked { "something "}
       end
     end
 
     it "should create an instance method when an action is defined at the class level" do
       @klass.action(:foo) do
         when_invoked { "something" }
       end
       @instance.foo.should == "something"
     end
 
     it "should be able to define an action at the instance level" do
       @instance.action(:foo) do
         when_invoked { "something "}
       end
     end
 
     it "should create an instance method when an action is defined at the instance level" do
       @instance.action(:foo) do
         when_invoked { "something" }
       end
       @instance.foo.should == "something"
     end
 
     it "should be able to list actions defined at the class level" do
       @klass.action(:foo) do
         when_invoked { "something" }
       end
       @klass.action(:bar) do
         when_invoked { "something" }
       end
 
       @klass.actions.should include(:bar)
       @klass.actions.should include(:foo)
     end
 
     it "should be able to list actions defined at the instance level" do
       @instance.action(:foo) do
         when_invoked { "something" }
       end
       @instance.action(:bar) do
         when_invoked { "something" }
       end
 
       @instance.actions.should include(:bar)
       @instance.actions.should include(:foo)
     end
 
     it "should be able to list actions defined at both instance and class level" do
       @klass.action(:foo) do
         when_invoked { "something" }
       end
       @instance.action(:bar) do
         when_invoked { "something" }
       end
 
       @instance.actions.should include(:bar)
       @instance.actions.should include(:foo)
     end
 
     it "should be able to indicate when an action is defined at the class level" do
       @klass.action(:foo) do
         when_invoked { "something" }
       end
       @instance.should be_action(:foo)
     end
 
     it "should be able to indicate when an action is defined at the instance level" do
       @klass.action(:foo) do
         when_invoked { "something" }
       end
       @instance.should be_action(:foo)
     end
 
     it "should list actions defined in superclasses" do
       @subclass = Class.new(@klass)
       @instance = @subclass.new
 
       @klass.action(:parent) do
         when_invoked { "a" }
       end
       @subclass.action(:sub) do
         when_invoked { "a" }
       end
       @instance.action(:instance) do
         when_invoked { "a" }
       end
 
       @instance.should be_action(:parent)
       @instance.should be_action(:sub)
       @instance.should be_action(:instance)
     end
 
     it "should create an instance method when an action is defined in a superclass" do
       @subclass = Class.new(@klass)
       @instance = @subclass.new
 
       @klass.action(:foo) do
         when_invoked { "something" }
       end
       @instance.foo.should == "something"
     end
   end
 
   describe "#action" do
     it 'should add an action' do
       subject.action(:foo) {  }
       subject.get_action(:foo).should be_a Puppet::Interface::Action
     end
 
     it 'should support default actions' do
       subject.action(:foo) { default }
       subject.get_default_action.should == subject.get_action(:foo)
     end
 
     it 'should not support more than one default action' do
       subject.action(:foo) { default }
       expect { subject.action(:bar) { default } }.should raise_error
     end
   end
 
   describe "#get_action" do
     let :parent_class do
       parent_class = Class.new(Puppet::Interface)
       parent_class.action(:foo) {}
       parent_class
     end
 
     it "should check that we can find inherited actions when we are a class" do
       Class.new(parent_class).get_action(:foo).name.should == :foo
     end
 
     it "should check that we can find inherited actions when we are an instance" do
       instance = parent_class.new(:foo, '0.0.0')
       instance.get_action(:foo).name.should == :foo
     end
   end
 end
diff --git a/spec/unit/interface/action_spec.rb b/spec/unit/interface/action_spec.rb
index 8c6782976..4be6a1c55 100755
--- a/spec/unit/interface/action_spec.rb
+++ b/spec/unit/interface/action_spec.rb
@@ -1,172 +1,351 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/interface/action'
 
 describe Puppet::Interface::Action do
   describe "when validating the action name" do
     [nil, '', 'foo bar', '-foobar'].each do |input|
       it "should treat #{input.inspect} as an invalid name" do
         expect { Puppet::Interface::Action.new(nil, input) }.
           should raise_error(/is an invalid action name/)
       end
     end
   end
 
   describe "when invoking" do
     it "should be able to call other actions on the same object" do
       face = Puppet::Interface.new(:my_face, '0.0.1') do
         action(:foo) do
           when_invoked { 25 }
         end
 
         action(:bar) do
           when_invoked { "the value of foo is '#{foo}'" }
         end
       end
       face.foo.should == 25
       face.bar.should == "the value of foo is '25'"
     end
 
     # bar is a class action calling a class action
     # quux is a class action calling an instance action
     # baz is an instance action calling a class action
     # qux is an instance action calling an instance action
     it "should be able to call other actions on the same object when defined on a class" do
       class Puppet::Interface::MyInterfaceBaseClass < Puppet::Interface
         action(:foo) do
           when_invoked { 25 }
         end
 
         action(:bar) do
           when_invoked { "the value of foo is '#{foo}'" }
         end
 
         action(:quux) do
           when_invoked { "qux told me #{qux}" }
         end
       end
 
       face = Puppet::Interface::MyInterfaceBaseClass.new(:my_inherited_face, '0.0.1') do
         action(:baz) do
           when_invoked { "the value of foo in baz is '#{foo}'" }
         end
 
         action(:qux) do
           when_invoked { baz }
         end
       end
       face.foo.should  == 25
       face.bar.should  == "the value of foo is '25'"
       face.quux.should == "qux told me the value of foo in baz is '25'"
       face.baz.should  == "the value of foo in baz is '25'"
       face.qux.should  == "the value of foo in baz is '25'"
     end
 
     context "when calling the Ruby API" do
       let :face do
         Puppet::Interface.new(:ruby_api, '1.0.0') do
           action :bar do
             when_invoked do |options|
               options
             end
           end
         end
       end
 
       it "should work when no options are supplied" do
         options = face.bar
         options.should == {}
       end
 
       it "should work when options are supplied" do
-        options = face.bar :bar => "beer"
+        options = face.bar(:bar => "beer")
         options.should == { :bar => "beer" }
       end
     end
   end
 
   describe "with action-level options" do
     it "should support options with an empty block" do
       face = Puppet::Interface.new(:action_level_options, '0.0.1') do
         action :foo do
           option "--bar" do
             # this line left deliberately blank
           end
         end
       end
 
       face.should_not be_option :bar
       face.get_action(:foo).should be_option :bar
     end
 
     it "should return only action level options when there are no face options" do
       face = Puppet::Interface.new(:action_level_options, '0.0.1') do
         action :foo do option "--bar" end
       end
 
       face.get_action(:foo).options.should =~ [:bar]
     end
 
     describe "with both face and action options" do
       let :face do
         Puppet::Interface.new(:action_level_options, '0.0.1') do
           action :foo do option "--bar" end
           action :baz do option "--bim" end
           option "--quux"
         end
       end
 
       it "should return combined face and action options" do
         face.get_action(:foo).options.should =~ [:bar, :quux]
       end
 
       it "should fetch options that the face inherited" do
         parent = Class.new(Puppet::Interface)
         parent.option "--foo"
         child = parent.new(:inherited_options, '0.0.1') do
           option "--bar"
           action :action do option "--baz" end
         end
 
         action = child.get_action(:action)
         action.should be
 
         [:baz, :bar, :foo].each do |name|
           action.get_option(name).should be_an_instance_of Puppet::Interface::Option
         end
       end
 
       it "should get an action option when asked" do
         face.get_action(:foo).get_option(:bar).
           should be_an_instance_of Puppet::Interface::Option
       end
 
       it "should get a face option when asked" do
         face.get_action(:foo).get_option(:quux).
           should be_an_instance_of Puppet::Interface::Option
       end
 
       it "should return options only for this action" do
         face.get_action(:baz).options.should =~ [:bim, :quux]
       end
     end
 
     it_should_behave_like "things that declare options" do
       def add_options_to(&block)
         face = Puppet::Interface.new(:with_options, '0.0.1') do
           action(:foo, &block)
         end
         face.get_action(:foo)
       end
     end
 
     it "should fail when a face option duplicates an action option" do
       expect {
         Puppet::Interface.new(:action_level_options, '0.0.1') do
           option "--foo"
           action :bar do option "--foo" end
         end
       }.should raise_error ArgumentError, /Option foo conflicts with existing option foo/i
     end
   end
+
+  context "with action decorators" do
+    context "local only" do
+      let :face do
+        Puppet::Interface.new(:action_decorators, '0.0.1') do
+          action :bar do when_invoked do true end end
+          def report(arg) end
+        end
+      end
+
+      it "should call action before decorators" do
+        face.action(:baz) do
+          option "--baz" do
+            before_action do |action, args, options|
+              report(:action_option)
+            end
+          end
+          when_invoked do true end
+        end
+
+        face.expects(:report).with(:action_option)
+        face.baz :baz => true
+      end
+
+      it "should call action after decorators" do
+        face.action(:baz) do
+          option "--baz" do
+            after_action do |action, args, options|
+              report(:action_option)
+            end
+          end
+          when_invoked do true end
+        end
+
+        face.expects(:report).with(:action_option)
+        face.baz :baz => true
+      end
+
+      it "should call local before decorators" do
+        face.option "--foo FOO" do
+          before_action do |action, args, options|
+            report(:before)
+          end
+        end
+        face.expects(:report).with(:before)
+        face.bar({:foo => 12})
+      end
+
+      it "should call local after decorators" do
+        face.option "--foo FOO" do
+          after_action do |action, args, options| report(:after) end
+        end
+        face.expects(:report).with(:after)
+        face.bar({:foo => 12})
+      end
+
+      context "with inactive decorators" do
+        it "should not invoke a decorator if the options are empty" do
+          face.option "--foo FOO" do
+            before_action do |action, args, options|
+              report :before_action
+            end
+          end
+          face.expects(:report).never # I am testing the negative.
+          face.bar
+        end
+
+        context "with some decorators only" do
+          before :each do
+            face.option "--foo" do
+              before_action do |action, args, options| report :foo end
+            end
+            face.option "--bar" do
+              before_action do |action, args, options| report :bar end
+            end
+          end
+
+          it "should work with the foo option" do
+            face.expects(:report).with(:foo)
+            face.bar(:foo => true)
+          end
+
+          it "should work with the bar option" do
+            face.expects(:report).with(:bar)
+            face.bar(:bar => true)
+          end
+
+          it "should work with both options" do
+            face.expects(:report).with(:foo)
+            face.expects(:report).with(:bar)
+            face.bar(:foo => true, :bar => true)
+          end
+        end
+      end
+    end
+
+    context "with inherited decorators" do
+      let :parent do
+        parent = Class.new(Puppet::Interface)
+        parent.script :on_parent do :on_parent end
+        parent.define_method :report do |arg| arg end
+        parent
+      end
+
+      let :child do
+        child = parent.new(:inherited_decorators, '0.0.1') do
+          script :on_child do :on_child end
+        end
+      end
+
+      context "with a child decorator" do
+        subject do
+          child.option "--foo FOO" do
+            before_action do |action, args, options|
+              report(:child_before)
+            end
+          end
+          child.expects(:report).with(:child_before)
+          child
+        end
+
+        it "child actions should invoke the decorator" do
+          subject.on_child({:foo => true, :bar => true}).should == :on_child
+        end
+
+        it "parent actions should invoke the decorator" do
+          subject.on_parent({:foo => true, :bar => true}).should == :on_parent
+        end
+      end
+
+      context "with a parent decorator" do
+        subject do
+          parent.option "--foo FOO" do
+            before_action do |action, args, options|
+              report(:parent_before)
+            end
+          end
+          child.expects(:report).with(:parent_before)
+          child
+        end
+
+        it "child actions should invoke the decorator" do
+          subject.on_child({:foo => true, :bar => true}).should == :on_child
+        end
+
+        it "parent actions should invoke the decorator" do
+          subject.on_parent({:foo => true, :bar => true}).should == :on_parent
+        end
+      end
+
+      context "with child and parent decorators" do
+        subject do
+          parent.option "--foo FOO" do
+            before_action { |action, args, options| report(:parent_before) }
+            after_action  { |action, args, options| report(:parent_after)  }
+          end
+          child.option "--bar BAR" do
+            before_action { |action, args, options| report(:child_before) }
+            after_action  { |action, args, options| report(:child_after)  }
+          end
+
+          child.expects(:report).with(:child_before)
+          child.expects(:report).with(:parent_before)
+          child.expects(:report).with(:parent_after)
+          child.expects(:report).with(:child_after)
+
+          child
+        end
+
+        it "child actions should invoke all the decorator" do
+          subject.on_child({:foo => true, :bar => true}).should == :on_child
+        end
+
+        it "parent actions should invoke all the decorator" do
+          subject.on_parent({:foo => true, :bar => true}).should == :on_parent
+        end
+      end
+    end
+  end
 end
diff --git a/spec/unit/interface/face_collection_spec.rb b/spec/unit/interface/face_collection_spec.rb
index d1114dde7..f9498cbb8 100755
--- a/spec/unit/interface/face_collection_spec.rb
+++ b/spec/unit/interface/face_collection_spec.rb
@@ -1,170 +1,166 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'tmpdir'
 require 'puppet/interface/face_collection'
 
 describe Puppet::Interface::FaceCollection do
   # To avoid cross-pollution we have to save and restore both the hash
   # containing all the interface data, and the array used by require.  Restoring
   # both means that we don't leak side-effects across the code. --daniel 2011-04-06
   #
   # Worse luck, we *also* need to flush $" of anything defining a face,
   # because otherwise we can cross-pollute from other test files and end up
   # with no faces loaded, but the require value set true. --daniel 2011-04-10
   before :each do
     @original_faces    = subject.instance_variable_get("@faces").dup
     @original_required = $".dup
     $".delete_if do |path| path =~ %r{/face/.*\.rb$} end
     subject.instance_variable_get("@faces").clear
   end
 
   after :each do
     subject.instance_variable_set("@faces", @original_faces)
     $".clear ; @original_required.each do |item| $" << item end
   end
 
-  describe "::faces" do
-    it "REVISIT: should have some tests here, if we describe it"
-  end
-
   describe "::validate_version" do
     it 'should permit three number versions' do
       subject.validate_version('10.10.10').should == true
     end
 
     it 'should permit versions with appended descriptions' do
       subject.validate_version('10.10.10beta').should == true
     end
 
     it 'should not permit versions with more than three numbers' do
       subject.validate_version('1.2.3.4').should == false
     end
 
     it 'should not permit versions with only two numbers' do
       subject.validate_version('10.10').should == false
     end
 
     it 'should not permit versions with only one number' do
       subject.validate_version('123').should == false
     end
 
     it 'should not permit versions with text in any position but at the end' do
       subject.validate_version('v1.1.1').should == false
     end
   end
 
   describe "::[]" do
     before :each do
       subject.instance_variable_get("@faces")[:foo]['0.0.1'] = 10
     end
 
     it "should return the face with the given name" do
       subject["foo", '0.0.1'].should == 10
     end
 
     it "should attempt to load the face if it isn't found" do
       subject.expects(:require).with('puppet/face/bar')
       subject["bar", '0.0.1']
     end
 
     it "should attempt to load the default face for the specified version :current" do
       subject.expects(:require).with('puppet/face/fozzie')
       subject['fozzie', :current]
     end
   end
 
   describe "::face?" do
     it "should return true if the face specified is registered" do
       subject.instance_variable_get("@faces")[:foo]['0.0.1'] = 10
       subject.face?("foo", '0.0.1').should == true
     end
 
     it "should attempt to require the face if it is not registered" do
       subject.expects(:require).with do |file|
         subject.instance_variable_get("@faces")[:bar]['0.0.1'] = true
         file == 'puppet/face/bar'
       end
       subject.face?("bar", '0.0.1').should == true
     end
 
     it "should return true if requiring the face registered it" do
       subject.stubs(:require).with do
         subject.instance_variable_get("@faces")[:bar]['0.0.1'] = 20
       end
     end
 
     it "should return false if the face is not registered" do
       subject.stubs(:require).returns(true)
       subject.face?("bar", '0.0.1').should be_false
     end
 
     it "should return false if the face file itself is missing" do
       subject.stubs(:require).
         raises(LoadError, 'no such file to load -- puppet/face/bar')
       subject.face?("bar", '0.0.1').should be_false
     end
 
     it "should register the version loaded by `:current` as `:current`" do
       subject.expects(:require).with do |file|
         subject.instance_variable_get("@faces")[:huzzah]['2.0.1'] = :huzzah_face
         file == 'puppet/face/huzzah'
       end
       subject.face?("huzzah", :current)
       subject.instance_variable_get("@faces")[:huzzah][:current].should == :huzzah_face
     end
 
     context "with something on disk" do
       it "should register the version loaded from `puppet/face/{name}` as `:current`" do
         subject.should be_face "huzzah", '2.0.1'
         subject.should be_face "huzzah", :current
         Puppet::Face[:huzzah, '2.0.1'].should == Puppet::Face[:huzzah, :current]
       end
 
       it "should index :current when the code was pre-required" do
         subject.instance_variable_get("@faces")[:huzzah].should_not be_key :current
         require 'puppet/face/huzzah'
         subject.face?(:huzzah, :current).should be_true
       end
     end
 
     it "should not cause an invalid face to be enumerated later" do
       subject.face?(:there_is_no_face, :current).should be_false
       subject.faces.should_not include :there_is_no_face
     end
   end
 
   describe "::register" do
     it "should store the face by name" do
       face = Puppet::Face.new(:my_face, '0.0.1')
       subject.register(face)
       subject.instance_variable_get("@faces").should == {:my_face => {'0.0.1' => face}}
     end
   end
 
   describe "::underscorize" do
     faulty = [1, "#foo", "$bar", "sturm und drang", :"sturm und drang"]
     valid  = {
       "Foo"      => :foo,
       :Foo       => :foo,
       "foo_bar"  => :foo_bar,
       :foo_bar   => :foo_bar,
       "foo-bar"  => :foo_bar,
       :"foo-bar" => :foo_bar,
     }
 
     valid.each do |input, expect|
       it "should map #{input.inspect} to #{expect.inspect}" do
         result = subject.underscorize(input)
         result.should == expect
       end
     end
 
     faulty.each do |input|
       it "should fail when presented with #{input.inspect} (#{input.class})" do
         expect { subject.underscorize(input) }.
           should raise_error ArgumentError, /not a valid face name/
       end
     end
   end
 end
diff --git a/spec/unit/interface/option_builder_spec.rb b/spec/unit/interface/option_builder_spec.rb
index fae48324e..b32b316f6 100755
--- a/spec/unit/interface/option_builder_spec.rb
+++ b/spec/unit/interface/option_builder_spec.rb
@@ -1,29 +1,60 @@
 require 'puppet/interface/option_builder'
 
 describe Puppet::Interface::OptionBuilder do
   let :face do Puppet::Interface.new(:option_builder_testing, '0.0.1') end
 
   it "should be able to construct an option without a block" do
     Puppet::Interface::OptionBuilder.build(face, "--foo").
       should be_an_instance_of Puppet::Interface::Option
   end
 
-  describe "when using the DSL block" do
-    it "should work with an empty block" do
-      option = Puppet::Interface::OptionBuilder.build(face, "--foo") do
-        # This block deliberately left blank.
-      end
+  it "should work with an empty block" do
+    option = Puppet::Interface::OptionBuilder.build(face, "--foo") do
+      # This block deliberately left blank.
+    end
 
-      option.should be_an_instance_of Puppet::Interface::Option
+    option.should be_an_instance_of Puppet::Interface::Option
+  end
+
+  it "should support documentation declarations" do
+    text = "this is the description"
+    option = Puppet::Interface::OptionBuilder.build(face, "--foo") do
+      desc text
     end
+    option.should be_an_instance_of Puppet::Interface::Option
+    option.desc.should == text
+  end
 
-    it "should support documentation declarations" do
-      text = "this is the description"
+  context "before_action hook" do
+    it "should support a before_action hook" do
       option = Puppet::Interface::OptionBuilder.build(face, "--foo") do
-        desc text
+        before_action do |a,b,c| :whatever end
       end
-      option.should be_an_instance_of Puppet::Interface::Option
-      option.desc.should == text
+      option.before_action.should be_an_instance_of UnboundMethod
+    end
+
+    it "should fail if the hook block takes too few arguments" do
+      expect do
+        Puppet::Interface::OptionBuilder.build(face, "--foo") do
+          before_action do |one, two| true end
+        end
+      end.to raise_error ArgumentError, /takes three arguments/
+    end
+
+    it "should fail if the hook block takes too many arguments" do
+      expect do
+        Puppet::Interface::OptionBuilder.build(face, "--foo") do
+          before_action do |one, two, three, four| true end
+        end
+      end.to raise_error ArgumentError, /takes three arguments/
+    end
+
+    it "should fail if the hook block takes a variable number of arguments" do
+      expect do
+        Puppet::Interface::OptionBuilder.build(face, "--foo") do
+          before_action do |*blah| true end
+        end
+      end.to raise_error ArgumentError, /takes three arguments/
     end
   end
 end
diff --git a/spec/unit/interface/option_spec.rb b/spec/unit/interface/option_spec.rb
index 3bcd121e2..4c24dc940 100755
--- a/spec/unit/interface/option_spec.rb
+++ b/spec/unit/interface/option_spec.rb
@@ -1,75 +1,99 @@
 require 'puppet/interface/option'
 
 describe Puppet::Interface::Option do
   let :face do Puppet::Interface.new(:option_testing, '0.0.1') end
 
   describe "#optparse_to_name" do
     ["", "=BAR", " BAR", "=bar", " bar"].each do |postfix|
       { "--foo" => :foo, "-f" => :f }.each do |base, expect|
         input = base + postfix
         it "should map #{input.inspect} to #{expect.inspect}" do
           option = Puppet::Interface::Option.new(face, input)
           option.name.should == expect
         end
       end
     end
 
     [:foo, 12, nil, {}, []].each do |input|
       it "should fail sensible when given #{input.inspect}" do
         expect { Puppet::Interface::Option.new(face, input) }.
           should raise_error ArgumentError, /is not valid for an option argument/
       end
     end
 
     ["-foo", "-foo=BAR", "-foo BAR"].each do |input|
       it "should fail with a single dash for long option #{input.inspect}" do
         expect { Puppet::Interface::Option.new(face, input) }.
           should raise_error ArgumentError, /long options need two dashes \(--\)/
       end
     end
   end
 
   it "requires a face when created" do
     expect { Puppet::Interface::Option.new }.
       should raise_error ArgumentError, /wrong number of arguments/
   end
 
   it "also requires some declaration arguments when created" do
     expect { Puppet::Interface::Option.new(face) }.
       should raise_error ArgumentError, /No option declarations found/
   end
 
   it "should infer the name from an optparse string" do
     option = Puppet::Interface::Option.new(face, "--foo")
     option.name.should == :foo
   end
 
   it "should infer the name when multiple optparse string are given" do
     option = Puppet::Interface::Option.new(face, "--foo", "-f")
     option.name.should == :foo
   end
 
   it "should prefer the first long option name over a short option name" do
     option = Puppet::Interface::Option.new(face, "-f", "--foo")
     option.name.should == :foo
   end
 
   it "should create an instance when given a face and name" do
     Puppet::Interface::Option.new(face, "--foo").
       should be_instance_of Puppet::Interface::Option
   end
 
   describe "#to_s" do
     it "should transform a symbol into a string" do
       option = Puppet::Interface::Option.new(face, "--foo")
       option.name.should == :foo
       option.to_s.should == "foo"
     end
 
     it "should use - rather than _ to separate words in strings but not symbols" do
       option = Puppet::Interface::Option.new(face, "--foo-bar")
       option.name.should == :foo_bar
       option.to_s.should == "foo-bar"
     end
   end
+
+  %w{before after}.each do |side|
+    describe "#{side} hooks" do
+      subject { Puppet::Interface::Option.new(face, "--foo") }
+      let :proc do Proc.new do :from_proc end end
+
+      it { should respond_to "#{side}_action" }
+      it { should respond_to "#{side}_action=" }
+
+      it "should set the #{side}_action hook" do
+        subject.send("#{side}_action").should be_nil
+        subject.send("#{side}_action=", proc)
+        subject.send("#{side}_action").should be_an_instance_of UnboundMethod
+      end
+
+      data = [1, "foo", :foo, Object.new, method(:hash), method(:hash).unbind]
+      data.each do |input|
+        it "should fail if a #{input.class} is added to the #{side} hooks" do
+          expect { subject.send("#{side}_action=", input) }.
+            to raise_error ArgumentError, /not a proc/
+        end
+      end
+    end
+  end
 end