diff --git a/lib/puppet/application.rb b/lib/puppet/application.rb
index 17ad69cee..7ef71bc81 100644
--- a/lib/puppet/application.rb
+++ b/lib/puppet/application.rb
@@ -1,407 +1,402 @@
 require 'optparse'
 
 # This class handles all the aspects of a Puppet application/executable
 # * setting up options
 # * setting up logs
 # * choosing what to run
 # * representing execution status
 #
 # === Usage
 # An application is a subclass of Puppet::Application.
 #
 # For legacy compatibility,
 #      Puppet::Application[:example].run
 # is equivalent to
 #      Puppet::Application::Example.new.run
 #
 #
 # class Puppet::Application::Example << Puppet::Application
 #
 #     def preinit
 #         # perform some pre initialization
 #         @all = false
 #     end
 #
 #     # run_command is called to actually run the specified command
 #     def run_command
 #         send Puppet::Util::CommandLine.new.args.shift
 #     end
 #
 #     # option uses metaprogramming to create a method
 #     # and also tells the option parser how to invoke that method
 #     option("--arg ARGUMENT") do |v|
 #         @args << v
 #     end
 #
 #     option("--debug", "-d") do |v|
 #         @debug = v
 #     end
 #
 #     option("--all", "-a:) do |v|
 #         @all = v
 #     end
 #
 #     def handle_unknown(opt,arg)
 #         # last chance to manage an option
 #         ...
 #         # let's say to the framework we finally handle this option
 #         true
 #     end
 #
 #     def read
 #         # read action
 #     end
 #
 #     def write
 #         # writeaction
 #     end
 #
 # end
 #
 # === Preinit
 # The preinit block is the first code to be called in your application, before option parsing,
 # setup or command execution.
 #
 # === Options
 # Puppet::Application uses +OptionParser+ to manage the application options.
 # Options are defined with the +option+ method to which are passed various
 # arguments, including the long option, the short option, a description...
 # Refer to +OptionParser+ documentation for the exact format.
 # * If the option method is given a block, this one will be called whenever
 # the option is encountered in the command-line argument.
 # * If the option method has no block, a default functionnality will be used, that
 # stores the argument (or true/false if the option doesn't require an argument) in
 # the global (to the application) options array.
 # * If a given option was not defined by a the +option+ method, but it exists as a Puppet settings:
 #  * if +unknown+ was used with a block, it will be called with the option name and argument
 #  * if +unknown+ wasn't used, then the option/argument is handed to Puppet.settings.handlearg for
 #    a default behavior
 #
 # --help is managed directly by the Puppet::Application class, but can be overriden.
 #
 # === Setup
 # Applications can use the setup block to perform any initialization.
 # The defaul +setup+ behaviour is to: read Puppet configuration and manage log level and destination
 #
 # === What and how to run
 # If the +dispatch+ block is defined it is called. This block should return the name of the registered command
 # to be run.
 # If it doesn't exist, it defaults to execute the +main+ command if defined.
 #
 # === Execution state
 # The class attributes/methods of Puppet::Application serve as a global place to set and query the execution
 # status of the application: stopping, restarting, etc.  The setting of the application status does not directly
 # aftect its running status; it's assumed that the various components within the application will consult these
 # settings appropriately and affect their own processing accordingly.  Control operations (signal handlers and
 # the like) should set the status appropriately to indicate to the overall system that it's the process of
 # stopping or restarting (or just running as usual).
 #
 # So, if something in your application needs to stop the process, for some reason, you might consider:
 #
 #  def stop_me!
 #      # indicate that we're stopping
 #      Puppet::Application.stop!
 #      # ...do stuff...
 #  end
 #
 # And, if you have some component that involves a long-running process, you might want to consider:
 #
 #  def my_long_process(giant_list_to_munge)
 #      giant_list_to_munge.collect do |member|
 #          # bail if we're stopping
 #          return if Puppet::Application.stop_requested?
 #          process_member(member)
 #      end
 #  end
 module Puppet
 class Application
   require 'puppet/util'
   include Puppet::Util
 
   DOCPATTERN = File.expand_path(File.dirname(__FILE__) + "/util/command_line/*" )
 
   class << self
     include Puppet::Util
 
     attr_accessor :run_status
 
     def clear!
       self.run_status = nil
     end
 
     def stop!
       self.run_status = :stop_requested
     end
 
     def restart!
       self.run_status = :restart_requested
     end
 
     # Indicates that Puppet::Application.restart! has been invoked and components should
     # do what is necessary to facilitate a restart.
     def restart_requested?
       :restart_requested == run_status
     end
 
     # Indicates that Puppet::Application.stop! has been invoked and components should do what is necessary
     # for a clean stop.
     def stop_requested?
       :stop_requested == run_status
     end
 
     # Indicates that one of stop! or start! was invoked on Puppet::Application, and some kind of process
     # shutdown/short-circuit may be necessary.
     def interrupted?
       [:restart_requested, :stop_requested].include? run_status
     end
 
     # Indicates that Puppet::Application believes that it's in usual running run_mode (no stop/restart request
     # currently active).
     def clear?
       run_status.nil?
     end
 
     # Only executes the given block if the run status of Puppet::Application is clear (no restarts, stops,
     # etc. requested).
     # Upon block execution, checks the run status again; if a restart has been requested during the block's
     # execution, then controlled_run will send a new HUP signal to the current process.
     # Thus, long-running background processes can potentially finish their work before a restart.
     def controlled_run(&block)
       return unless clear?
       result = block.call
       Process.kill(:HUP, $PID) if restart_requested?
       result
     end
 
     def should_parse_config
       @parse_config = true
     end
 
     def should_not_parse_config
       @parse_config = false
     end
 
     def should_parse_config?
       @parse_config = true if ! defined?(@parse_config)
       @parse_config
     end
 
     # used to declare code that handle an option
     def option(*options, &block)
       long = options.find { |opt| opt =~ /^--/ }.gsub(/^--(?:\[no-\])?([^ =]+).*$/, '\1' ).gsub('-','_')
       fname = symbolize("handle_#{long}")
       if (block_given?)
         define_method(fname, &block)
       else
         define_method(fname) do |value|
           self.options["#{long}".to_sym] = value
         end
       end
       self.option_parser_commands << [options, fname]
     end
 
     def banner(banner = nil)
       @banner ||= banner
     end
 
     def option_parser_commands
       @option_parser_commands ||= (
         superclass.respond_to?(:option_parser_commands) ? superclass.option_parser_commands.dup : []
       )
       @option_parser_commands
     end
 
     def find(name)
       klass = name.to_s.capitalize
 
       # const_defined? is used before const_get since const_defined? will only
       # check within our namespace, whereas const_get will check ancestor
       # trees as well, resulting in unexpected behaviour.
       if !self.const_defined?(klass)
         puts "Unable to find application '#{name.to_s}'."
         Kernel::exit(1)
       end
 
       self.const_get(klass)
     end
 
     def [](name)
       find(name).new
     end
 
     # Sets or gets the run_mode name. Sets the run_mode name if a mode_name is
     # passed. Otherwise, gets the run_mode or a default run_mode
     #
     def run_mode( mode_name = nil)
       return @run_mode if @run_mode and not mode_name
 
       require 'puppet/util/run_mode'
       @run_mode = Puppet::Util::RunMode[ mode_name || :user ]
     end
   end
 
   attr_reader :options, :command_line
 
   # Every app responds to --version
   option("--version", "-V") do |arg|
     puts "#{Puppet.version}"
     exit
   end
 
   # Every app responds to --help
   option("--help", "-h") do |v|
-    help
+    puts help
+    exit
   end
 
   def should_parse_config?
     self.class.should_parse_config?
   end
 
   # override to execute code before running anything else
   def preinit
   end
 
   def initialize(command_line = nil)
     require 'puppet/util/command_line'
     @command_line = command_line || Puppet::Util::CommandLine.new
-    @run_mode = self.class.run_mode
+    set_run_mode self.class.run_mode
     @options = {}
 
+    require 'puppet'
+  end
+
+  # WARNING: This is a totally scary, frightening, and nasty internal API.  We
+  # strongly advise that you do not use this, and if you insist, we will
+  # politely allow you to keep both pieces of your broken code.
+  #
+  # We plan to provide a supported, long-term API to deliver this in a way
+  # that you can use.  Please make sure that you let us know if you do require
+  # this, and this message is still present in the code. --daniel 2011-02-03
+  def set_run_mode(mode)
+    @run_mode = mode
     $puppet_application_mode = @run_mode
     $puppet_application_name = name
 
     if Puppet.respond_to? :settings
       # This is to reduce the amount of confusion in rspec
       # because it might have loaded defaults.rb before the globals were set
       # and thus have the wrong defaults for the current application
       Puppet.settings.set_value(:confdir, Puppet.run_mode.conf_dir, :mutable_defaults)
       Puppet.settings.set_value(:vardir, Puppet.run_mode.var_dir, :mutable_defaults)
       Puppet.settings.set_value(:name, Puppet.application_name.to_s, :mutable_defaults)
       Puppet.settings.set_value(:logdir, Puppet.run_mode.logopts, :mutable_defaults)
       Puppet.settings.set_value(:rundir, Puppet.run_mode.run_dir, :mutable_defaults)
       Puppet.settings.set_value(:run_mode, Puppet.run_mode.name.to_s, :mutable_defaults)
     end
-
-    require 'puppet'
   end
 
   # This is the main application entry point
   def run
     exit_on_fail("initialize") { preinit }
     exit_on_fail("parse options") { parse_options }
     exit_on_fail("parse configuration file") { Puppet.settings.parse } if should_parse_config?
     exit_on_fail("prepare for execution") { setup }
     exit_on_fail("run") { run_command }
   end
 
   def main
     raise NotImplementedError, "No valid command or main"
   end
 
   def run_command
     main
   end
 
   def setup
     # Handle the logging settings
     if options[:debug] or options[:verbose]
       Puppet::Util::Log.newdestination(:console)
       if options[:debug]
         Puppet::Util::Log.level = :debug
       else
         Puppet::Util::Log.level = :info
       end
     end
 
     Puppet::Util::Log.newdestination(:syslog) unless options[:setdest]
   end
 
   def parse_options
     # Create an option parser
     option_parser = OptionParser.new(self.class.banner)
 
     # Add all global options to it.
     Puppet.settings.optparse_addargs([]).each do |option|
       option_parser.on(*option) do |arg|
         handlearg(option[0], arg)
       end
     end
 
     # Add options that are local to this application, which were
     # created using the "option()" metaprogramming method.  If there
     # are any conflicts, this application's options will be favored.
     self.class.option_parser_commands.each do |options, fname|
       option_parser.on(*options) do |value|
         # Call the method that "option()" created.
         self.send(fname, value)
       end
     end
 
     # scan command line.
     begin
       option_parser.parse!(self.command_line.args)
     rescue OptionParser::ParseError => detail
       $stderr.puts detail
       $stderr.puts "Try 'puppet #{command_line.subcommand_name} --help'"
       exit(1)
     end
   end
 
   def handlearg(opt, arg)
     # rewrite --[no-]option to --no-option if that's what was given
     if opt =~ /\[no-\]/ and !arg
       opt = opt.gsub(/\[no-\]/,'no-')
     end
     # otherwise remove the [no-] prefix to not confuse everybody
     opt = opt.gsub(/\[no-\]/, '')
     unless respond_to?(:handle_unknown) and send(:handle_unknown, opt, arg)
       # Puppet.settings.handlearg doesn't handle direct true/false :-)
       if arg.is_a?(FalseClass)
         arg = "false"
       elsif arg.is_a?(TrueClass)
         arg = "true"
       end
       Puppet.settings.handlearg(opt, arg)
     end
   end
 
   # this is used for testing
   def self.exit(code)
     exit(code)
   end
 
   def name
     self.class.to_s.sub(/.*::/,"").downcase.to_sym
   end
 
   def help
-    if Puppet.features.usage?
-      # RH:FIXME: My goodness, this is ugly.
-      ::RDoc.const_set("PuppetSourceFile", name)
-      #:stopdoc: # Issue #4161
-      def (::RDoc).caller
-        docfile = `grep -l 'Puppet::Application\\[:#{::RDoc::PuppetSourceFile}\\]' #{DOCPATTERN}`.chomp
-        super << "#{docfile}:0"
-      end
-      #:startdoc:
-      ::RDoc::usage && exit
-    else
-      puts "No help available unless you have RDoc::usage installed"
-      exit
-    end
-  rescue Errno::ENOENT
-    puts "No help available for puppet #{name}"
-    exit
+    "No help available for puppet #{name}"
   end
 
   private
 
   def exit_on_fail(message, code = 1)
       yield
   rescue RuntimeError, NotImplementedError => detail
       puts detail.backtrace if Puppet[:trace]
       $stderr.puts "Could not #{message}: #{detail}"
       exit(code)
   end
 end
 end
diff --git a/lib/puppet/application/agent.rb b/lib/puppet/application/agent.rb
index 96f33296f..fa1ec58a5 100644
--- a/lib/puppet/application/agent.rb
+++ b/lib/puppet/application/agent.rb
@@ -1,271 +1,477 @@
 require 'puppet/application'
 
 class Puppet::Application::Agent < Puppet::Application
 
   should_parse_config
   run_mode :agent
 
   attr_accessor :args, :agent, :daemon, :host
 
   def preinit
     # Do an initial trap, so that cancels don't get a stack trace.
     trap(:INT) do
       $stderr.puts "Cancelling startup"
       exit(0)
     end
 
     {
       :waitforcert => nil,
       :detailed_exitcodes => false,
       :verbose => false,
       :debug => false,
       :centrallogs => false,
       :setdest => false,
       :enable => false,
       :disable => false,
       :client => true,
       :fqdn => nil,
       :serve => [],
       :digest => :MD5,
       :fingerprint => false,
     }.each do |opt,val|
       options[opt] = val
     end
 
     @args = {}
     require 'puppet/daemon'
     @daemon = Puppet::Daemon.new
     @daemon.argv = ARGV.dup
   end
 
   option("--centrallogging")
   option("--disable")
   option("--enable")
   option("--debug","-d")
   option("--fqdn FQDN","-f")
   option("--test","-t")
   option("--verbose","-v")
 
   option("--fingerprint")
   option("--digest DIGEST")
 
   option("--serve HANDLER", "-s") do |arg|
     if Puppet::Network::Handler.handler(arg)
       options[:serve] << arg.to_sym
     else
       raise "Could not find handler for #{arg}"
     end
   end
 
   option("--no-client") do |arg|
     options[:client] = false
   end
 
   option("--detailed-exitcodes") do |arg|
     options[:detailed_exitcodes] = true
   end
 
   option("--logdest DEST", "-l DEST") do |arg|
     begin
       Puppet::Util::Log.newdestination(arg)
       options[:setdest] = true
     rescue => detail
       puts detail.backtrace if Puppet[:debug]
       $stderr.puts detail.to_s
     end
   end
 
   option("--waitforcert WAITFORCERT", "-w") do |arg|
     options[:waitforcert] = arg.to_i
   end
 
   option("--port PORT","-p") do |arg|
     @args[:Port] = arg
   end
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+Retrieve the client configuration from the puppet master and apply it to
+the local host.
+
+Currently must be run out periodically, using cron or something similar.
+
+
+USAGE
+=====
+  puppet agent  [-D|--daemonize|--no-daemonize] [-d|--debug]
+      [--detailed-exitcodes] [--disable] [--enable]
+      [-h|--help] [--certname <host name>] [-l|--logdest syslog|<file>|console]
+      [-o|--onetime] [--serve <handler>] [-t|--test] [--noop]
+      [--digest <digest>] [--fingerprint] [-V|--version]
+      [-v|--verbose] [-w|--waitforcert <seconds>]
+
+
+DESCRIPTION
+===========
+This is the main puppet client. Its job is to retrieve the local
+machine's configuration from a remote server and apply it. In order to
+successfully communicate with the remote server, the client must have a
+certificate signed by a certificate authority that the server trusts;
+the recommended method for this, at the moment, is to run a certificate
+authority as part of the puppet server (which is the default). The
+client will connect and request a signed certificate, and will continue
+connecting until it receives one.
+
+Once the client has a signed certificate, it will retrieve its
+configuration and apply it.
+
+
+USAGE NOTES
+===========
+'puppet agent' does its best to find a compromise between interactive
+use and daemon use. Run with no arguments and no configuration, it will
+go into the backgroun, attempt to get a signed certificate, and retrieve
+and apply its configuration every 30 minutes.
+
+Some flags are meant specifically for interactive use -- in particular,
+'test', 'tags' or 'fingerprint' are useful. 'test' enables verbose
+logging, causes the daemon to stay in the foreground, exits if the
+server's configuration is invalid (this happens if, for instance, you've
+left a syntax error on the server), and exits after running the
+configuration once (rather than hanging around as a long-running
+process).
+
+'tags' allows you to specify what portions of a configuration you want
+to apply. Puppet elements are tagged with all of the class or definition
+names that contain them, and you can use the 'tags' flag to specify one
+of these names, causing only configuration elements contained within
+that class or definition to be applied. This is very useful when you are
+testing new configurations -- for instance, if you are just starting to
+manage 'ntpd', you would put all of the new elements into an 'ntpd'
+class, and call puppet with '--tags ntpd', which would only apply that
+small portion of the configuration during your testing, rather than
+applying the whole thing.
+
+'fingerprint' is a one-time flag. In this mode 'puppet agent' will run
+once and display on the console (and in the log) the current certificate
+(or certificate request) fingerprint. Providing the '--digest' option
+allows to use a different digest algorithm to generate the fingerprint.
+The main use is to verify that before signing a certificate request on
+the master, the certificate request the master received is the same as
+the one the client sent (to prevent against man-in-the-middle attacks
+when signing certificates).
+
+
+OPTIONS
+=======
+Note that any configuration parameter that's valid in the configuration
+file is also a valid long argument. For example, 'server' is a valid
+configuration parameter, so you can specify '--server <servername>' as
+an argument.
+
+See the configuration file documentation at
+http://docs.puppetlabs.com/references/stable/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet agent with
+'--genconfig'.
+
+daemonize:          Send the process into the background. This is the
+                    default.
+
+no-daemonize:       Do not send the process into the background.
+
+debug:              Enable full debugging.
+
+digest:             Change the certificate fingerprinting digest
+                    algorithm. The default is MD5. Valid values depends
+                    on the version of OpenSSL installed, but should
+                    always at least contain MD5, MD2, SHA1 and SHA256.
+
+detailed-exitcodes: Provide transaction information via exit codes. If
+                    this is enabled, an exit code of '2' means there
+                    were changes, and an exit code of '4' means that
+                    there were failures during the transaction. This
+                    option only makes sense in conjunction with
+                    --onetime.
+
+disable:            Disable working on the local system. This puts a
+                    lock file in place, causing 'puppet agent' not to
+                    work on the system until the lock file is removed.
+                    This is useful if you are testing a configuration
+                    and do not want the central configuration to
+                    override the local state until everything is tested
+                    and committed.
+
+'puppet agent' uses the same lock file while it is running, so no more
+than one 'puppet agent' process is working at a time.
+
+'puppet agent' exits after executing this.
+
+enable:             Enable working on the local system. This removes any
+                    lock file, causing 'puppet agent' to start managing
+                    the local system again (although it will continue to
+                    use its normal scheduling, so it might not start for
+                    another half hour).
+
+'puppet agent' exits after executing this.
+
+certname:           Set the certname (unique ID) of the client. The
+                    master reads this unique identifying string, which
+                    is usually set to the node's fully-qualified domain
+                    name, to determine which configurations the node
+                    will receive. Use this option to debug setup
+                    problems or implement unusual node identification
+                    schemes.
+
+help:               Print this help message
+
+logdest:            Where to send messages. Choose between syslog, the
+                    console, and a log file. Defaults to sending
+                    messages to syslog, or the console if debugging or
+                    verbosity is enabled.
+
+no-client:          Do not create a config client. This will cause the
+                    daemon to run without ever checking for its
+                    configuration automatically, and only makes sense
+
+onetime:            Run the configuration once. Runs a single (normally
+                    daemonized) Puppet run. Useful for interactively
+                    running puppet agent when used in conjunction with
+                    the --no-daemonize option.
+
+fingerprint:        Display the current certificate or certificate
+                    signing request fingerprint and then exit. Use the
+                    '--digest' option to change the digest algorithm
+                    used.
+
+serve:              Start another type of server. By default, 'puppet
+                    agent' will start a service handler that allows
+                    authenticated and authorized remote nodes to trigger
+                    the configuration to be pulled down and applied. You
+                    can specify any handler here that does not require
+                    configuration, e.g., filebucket, ca, or resource.
+                    The handlers are in 'lib/puppet/network/handler',
+                    and the names must match exactly, both in the call
+                    to 'serve' and in 'namespaceauth.conf'.
+
+test:               Enable the most common options used for testing.
+                    These are 'onetime', 'verbose', 'ignorecache',
+                    'no-daemonize', 'no-usecacheonfailure',
+                    'detailed-exit-codes', 'no-splay', and 'show_diff'.
+
+noop:               Use 'noop' mode where the daemon runs in a no-op or
+                    dry-run mode. This is useful for seeing what changes
+                    Puppet will make without actually executing the
+                    changes.
+
+verbose:            Turn on verbose reporting.
+
+version:            Print the puppet version number and exit.
+
+waitforcert:        This option only matters for daemons that do not yet
+                    have certificates and it is enabled by default, with
+                    a value of 120 (seconds). This causes 'puppet agent'
+                    to connect to the server every 2 minutes and ask it
+                    to sign a certificate request. This is useful for
+                    the initial setup of a puppet client. You can turn
+                    off waiting for certificates by specifying a time of
+                    0.
+
+
+EXAMPLE
+=======
+  puppet agent --server puppet.domain.com
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005, 2006 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def run_command
     return fingerprint if options[:fingerprint]
     return onetime if Puppet[:onetime]
     main
   end
 
   def fingerprint
     unless cert = host.certificate || host.certificate_request
       $stderr.puts "Fingerprint asked but no certificate nor certificate request have yet been issued"
       exit(1)
       return
     end
     unless fingerprint = cert.fingerprint(options[:digest])
       raise ArgumentError, "Could not get fingerprint for digest '#{options[:digest]}'"
     end
     Puppet.notice fingerprint
   end
 
   def onetime
     unless options[:client]
       $stderr.puts "onetime is specified but there is no client"
       exit(43)
       return
     end
 
     @daemon.set_signal_traps
 
     begin
       report = @agent.run
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       Puppet.err detail.to_s
     end
 
     if not report
       exit(1)
     elsif not Puppet[:noop] and options[:detailed_exitcodes] then
       exit(report.exit_status)
     else
       exit(0)
     end
   end
 
   def main
     Puppet.notice "Starting Puppet client version #{Puppet.version}"
 
     @daemon.start
   end
 
   # Enable all of the most common test options.
   def setup_test
     Puppet.settings.handlearg("--ignorecache")
     Puppet.settings.handlearg("--no-usecacheonfailure")
     Puppet.settings.handlearg("--no-splay")
     Puppet.settings.handlearg("--show_diff")
     Puppet.settings.handlearg("--no-daemonize")
     options[:verbose] = true
     Puppet[:onetime] = true
     options[:detailed_exitcodes] = true
   end
 
   # Handle the logging settings.
   def setup_logs
     if options[:debug] or options[:verbose]
       Puppet::Util::Log.newdestination(:console)
       if options[:debug]
         Puppet::Util::Log.level = :debug
       else
         Puppet::Util::Log.level = :info
       end
     end
 
     Puppet::Util::Log.newdestination(:syslog) unless options[:setdest]
   end
 
   def enable_disable_client(agent)
     if options[:enable]
       agent.enable
     elsif options[:disable]
       agent.disable
     end
     exit(0)
   end
 
   def setup_listen
     unless FileTest.exists?(Puppet[:authconfig])
       Puppet.err "Will not start without authorization file #{Puppet[:authconfig]}"
       exit(14)
     end
 
     handlers = nil
 
     if options[:serve].empty?
       handlers = [:Runner]
     else
       handlers = options[:serve]
     end
 
     require 'puppet/network/server'
     # No REST handlers yet.
     server = Puppet::Network::Server.new(:xmlrpc_handlers => handlers, :port => Puppet[:puppetport])
 
     @daemon.server = server
   end
 
   def setup_host
     @host = Puppet::SSL::Host.new
     waitforcert = options[:waitforcert] || (Puppet[:onetime] ? 0 : 120)
     cert = @host.wait_for_cert(waitforcert) unless options[:fingerprint]
   end
 
   def setup
     setup_test if options[:test]
 
     setup_logs
 
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     # If noop is set, then also enable diffs
     Puppet[:show_diff] = true if Puppet[:noop]
 
     args[:Server] = Puppet[:server]
     if options[:fqdn]
       args[:FQDN] = options[:fqdn]
       Puppet[:certname] = options[:fqdn]
     end
 
     if options[:centrallogs]
       logdest = args[:Server]
 
       logdest += ":" + args[:Port] if args.include?(:Port)
       Puppet::Util::Log.newdestination(logdest)
     end
 
     Puppet.settings.use :main, :agent, :ssl
 
     # Always ignoreimport for agent. It really shouldn't even try to import,
     # but this is just a temporary band-aid.
     Puppet[:ignoreimport] = true
 
     # We need to specify a ca location for all of the SSL-related i
     # indirected classes to work; in fingerprint mode we just need
     # access to the local files and we don't need a ca.
     Puppet::SSL::Host.ca_location = options[:fingerprint] ? :none : :remote
 
     Puppet::Transaction::Report.indirection.terminus_class = :rest
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 
     # Override the default; puppetd needs this, usually.
     # You can still override this on the command-line with, e.g., :compiler.
     Puppet[:catalog_terminus] = :rest
 
     # Override the default.
     Puppet[:facts_terminus] = :facter
 
     Puppet::Resource::Catalog.indirection.cache_class = :yaml
 
     # We need tomake the client either way, we just don't start it
     # if --no-client is set.
     require 'puppet/agent'
     require 'puppet/configurer'
     @agent = Puppet::Agent.new(Puppet::Configurer)
 
     enable_disable_client(@agent) if options[:enable] or options[:disable]
 
     @daemon.agent = agent if options[:client]
 
     # It'd be nice to daemonize later, but we have to daemonize before the
     # waitforcert happens.
     @daemon.daemonize if Puppet[:daemonize]
 
     setup_host
 
     @objects = []
 
     # This has to go after the certs are dealt with.
     if Puppet[:listen]
       unless Puppet[:onetime]
         setup_listen
       else
         Puppet.notice "Ignoring --listen on onetime run"
       end
     end
   end
 end
diff --git a/lib/puppet/application/apply.rb b/lib/puppet/application/apply.rb
index e5b4bb5b7..1a5ab2c0c 100644
--- a/lib/puppet/application/apply.rb
+++ b/lib/puppet/application/apply.rb
@@ -1,160 +1,236 @@
 require 'puppet/application'
 
 class Puppet::Application::Apply < Puppet::Application
 
   should_parse_config
 
   option("--debug","-d")
   option("--execute EXECUTE","-e") do |arg|
     options[:code] = arg
   end
   option("--loadclasses","-L")
   option("--verbose","-v")
   option("--use-nodes")
   option("--detailed-exitcodes")
 
   option("--apply catalog",  "-a catalog") do |arg|
     options[:catalog] = arg
   end
 
   option("--logdest LOGDEST", "-l") do |arg|
     begin
       Puppet::Util::Log.newdestination(arg)
       options[:logset] = true
     rescue => detail
       $stderr.puts detail.to_s
     end
   end
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+Run a stand-alone 'puppet' manifest.
+
+
+USAGE
+=====
+  puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose] [-e|--execute]
+              [--detailed-exitcodes] [-l|--logdest <file>] <file>
+
+
+DESCRIPTION
+===========
+This is the standalone puppet execution tool; use it to execute
+individual manifests that you write. If you need to execute site-wide
+manifests, use 'puppet agent' and 'puppet master'.
+
+
+OPTIONS
+=======
+Note that any configuration parameter that's valid in the configuration
+file is also a valid long argument. For example, 'ssldir' is a valid
+configuration parameter, so you can specify '--ssldir <directory>' as an
+argument.
+
+See the configuration file documentation at
+http://docs.puppetlabs.com/references/stable/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet with
+'--genconfig'.
+
+debug:              Enable full debugging.
+
+detailed-exitcodes: Provide transaction information via exit codes. If
+                    this is enabled, an exit code of '2' means there
+                    were changes, and an exit code of '4' means that
+                    there were failures during the transaction.
+
+help:               Print this help message
+
+loadclasses:        Load any stored classes. 'puppet agent' caches
+                    configured classes (usually at
+                    /etc/puppet/classes.txt), and setting this option
+                    causes all of those classes to be set in your puppet
+                    manifest.
+
+logdest:            Where to send messages. Choose between syslog, the
+                    console, and a log file. Defaults to sending
+                    messages to the console.
+
+execute:            Execute a specific piece of Puppet code
+
+verbose:            Print extra information.
+
+
+EXAMPLE
+=======
+  puppet -l /tmp/manifest.log manifest.pp
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def run_command
     if options[:catalog]
       apply
     elsif Puppet[:parseonly]
       parseonly
     else
       main
     end
   end
 
   def apply
     if options[:catalog] == "-"
       text = $stdin.read
     else
       text = File.read(options[:catalog])
     end
 
     begin
       catalog = Puppet::Resource::Catalog.convert_from(Puppet::Resource::Catalog.default_format,text)
       catalog = Puppet::Resource::Catalog.pson_create(catalog) unless catalog.is_a?(Puppet::Resource::Catalog)
     rescue => detail
       raise Puppet::Error, "Could not deserialize catalog from pson: #{detail}"
     end
 
     catalog = catalog.to_ral
 
     require 'puppet/configurer'
     configurer = Puppet::Configurer.new
     configurer.run :catalog => catalog
   end
 
   def parseonly
     # Set our code or file to use.
     if options[:code] or command_line.args.length == 0
       Puppet[:code] = options[:code] || STDIN.read
     else
       Puppet[:manifest] = command_line.args.shift
     end
     begin
       Puppet::Node::Environment.new(Puppet[:environment]).known_resource_types
     rescue => detail
       Puppet.err detail
       exit 1
     end
     exit 0
   end
 
   def main
     # Set our code or file to use.
     if options[:code] or command_line.args.length == 0
       Puppet[:code] = options[:code] || STDIN.read
     else
       manifest = command_line.args.shift
       raise "Could not find file #{manifest}" unless File.exist?(manifest)
       Puppet.warning("Only one file can be applied per run.  Skipping #{command_line.args.join(', ')}") if command_line.args.size > 0
       Puppet[:manifest] = manifest
     end
 
     # Collect our facts.
     unless facts = Puppet::Node::Facts.indirection.find(Puppet[:certname])
       raise "Could not find facts for #{Puppet[:certname]}"
     end
 
     # Find our Node
     unless node = Puppet::Node.indirection.find(Puppet[:certname])
       raise "Could not find node #{Puppet[:certname]}"
     end
 
     # Merge in the facts.
     node.merge(facts.values)
 
     # Allow users to load the classes that puppet agent creates.
     if options[:loadclasses]
       file = Puppet[:classfile]
       if FileTest.exists?(file)
         unless FileTest.readable?(file)
           $stderr.puts "#{file} is not readable"
           exit(63)
         end
         node.classes = File.read(file).split(/[\s\n]+/)
       end
     end
 
     begin
       # Compile our catalog
       starttime = Time.now
       catalog = Puppet::Resource::Catalog.indirection.find(node.name, :use_node => node)
 
       # Translate it to a RAL catalog
       catalog = catalog.to_ral
 
       catalog.finalize
 
       catalog.retrieval_duration = Time.now - starttime
 
       require 'puppet/configurer'
       configurer = Puppet::Configurer.new
       report = configurer.run(:skip_plugin_download => true, :catalog => catalog)
 
       exit( Puppet[:noop] ? 0 : options[:detailed_exitcodes] ? report.exit_status : 0 )
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       $stderr.puts detail.message
       exit(1)
     end
   end
 
   def setup
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     # If noop is set, then also enable diffs
     Puppet[:show_diff] = true if Puppet[:noop]
 
     Puppet::Util::Log.newdestination(:console) unless options[:logset]
     client = nil
     server = nil
 
     trap(:INT) do
       $stderr.puts "Exiting"
       exit(1)
     end
 
     # we want the last report to be persisted locally
     Puppet::Transaction::Report.indirection.cache_class = :yaml
 
     if options[:debug]
       Puppet::Util::Log.level = :debug
     elsif options[:verbose]
       Puppet::Util::Log.level = :info
     end
   end
 end
diff --git a/lib/puppet/application/cert.rb b/lib/puppet/application/cert.rb
index 467b0c859..0db968e9e 100644
--- a/lib/puppet/application/cert.rb
+++ b/lib/puppet/application/cert.rb
@@ -1,85 +1,196 @@
 require 'puppet/application'
 
 class Puppet::Application::Cert < Puppet::Application
 
   should_parse_config
   run_mode :master
 
   attr_accessor :cert_mode, :all, :ca, :digest, :signed
 
   def find_mode(opt)
     require 'puppet/ssl/certificate_authority'
     modes = Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS
     tmp = opt.sub("--", '').to_sym
     @cert_mode = modes.include?(tmp) ? tmp : nil
   end
 
   option("--clean", "-c") do
     @cert_mode = :destroy
   end
 
   option("--all", "-a") do
     @all = true
   end
 
   option("--digest DIGEST") do |arg|
     @digest = arg
   end
 
   option("--signed", "-s") do
     @signed = true
   end
 
   option("--debug", "-d") do |arg|
     Puppet::Util::Log.level = :debug
   end
 
   require 'puppet/ssl/certificate_authority/interface'
   Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject {|m| m == :destroy }.each do |method|
     option("--#{method}", "-#{method.to_s[0,1]}") do
       find_mode("--#{method}")
     end
   end
 
   option("--verbose", "-v") do
     Puppet::Util::Log.level = :info
   end
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+Stand-alone certificate authority. Capable of generating certificates
+but mostly meant for signing certificate requests from puppet clients.
+
+
+USAGE
+=====
+  puppet cert [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
+              [-g|--generate] [-l|--list] [-s|--sign] [-r|--revoke]
+              [-p|--print] [-c|--clean] [--verify] [--digest DIGEST]
+              [--fingerprint] [host]
+
+
+DESCRIPTION
+===========
+Because the puppetmasterd daemon defaults to not signing client
+certificate requests, this script is available for signing outstanding
+requests. It can be used to list outstanding requests and then either
+sign them individually or sign all of them.
+
+
+OPTIONS
+=======
+Note that any configuration parameter that's valid in the configuration
+file is also a valid long argument. For example, 'ssldir' is a valid
+configuration parameter, so you can specify '--ssldir <directory>' as an
+argument.
+
+See the configuration file documentation at
+http://docs.puppetlabs.com/references/stable/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet cert with
+'--genconfig'.
+
+all:         Operate on all items. Currently only makes sense with
+             '--sign', '--clean', or '--list'.
+
+digest:      Set the digest for fingerprinting (defaults to md5). Valid
+             values depends on your openssl and openssl ruby extension
+             version, but should contain at least md5, sha1, md2,
+             sha256.
+
+clean:       Remove all files related to a host from puppet cert's
+             storage. This is useful when rebuilding hosts, since new
+             certificate signing requests will only be honored if puppet
+             cert does not have a copy of a signed certificate for that
+             host. The certificate of the host is also revoked. If
+             '--all' is specified then all host certificates, both
+             signed and unsigned, will be removed.
+
+debug:       Enable full debugging.
+
+generate:    Generate a certificate for a named client. A
+             certificate/keypair will be generated for each client named
+             on the command line.
+
+help:        Print this help message
+
+list:        List outstanding certificate requests. If '--all' is
+             specified, signed certificates are also listed, prefixed by
+             '+', and revoked or invalid certificates are prefixed by
+             '-' (the verification outcome is printed in parenthesis).
+
+print:       Print the full-text version of a host's certificate.
+
+fingerprint: Print the DIGEST (defaults to md5) fingerprint of a host's
+             certificate.
+
+revoke:      Revoke the certificate of a client. The certificate can be
+             specified either by its serial number, given as a decimal
+             number or a hexadecimal number prefixed by '0x', or by its
+             hostname. The certificate is revoked by adding it to the
+             Certificate Revocation List given by the 'cacrl' config
+             parameter. Note that the puppetmasterd needs to be
+             restarted after revoking certificates.
+
+sign:        Sign an outstanding certificate request. Unless '--all' is
+             specified, hosts must be listed after all flags.
+
+verbose:     Enable verbosity.
+
+version:     Print the puppet version number and exit.
+
+verify:      Verify the named certificate against the local CA
+             certificate.
+
+
+EXAMPLE
+=======
+  $ puppet cert -l
+  culain.madstop.com
+  $ puppet cert -s culain.madstop.com
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def main
     if @all
       hosts = :all
     elsif @signed
       hosts = :signed
     else
       hosts = command_line.args.collect { |h| h.downcase }
     end
     begin
       @ca.apply(:revoke, :to => hosts) if @cert_mode == :destroy
       @ca.apply(@cert_mode, :to => hosts, :digest => @digest)
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       puts detail.to_s
       exit(24)
     end
   end
 
   def setup
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     Puppet::Util::Log.newdestination :console
 
     if [:generate, :destroy].include? @cert_mode
       Puppet::SSL::Host.ca_location = :local
     else
       Puppet::SSL::Host.ca_location = :only
     end
 
     begin
       @ca = Puppet::SSL::CertificateAuthority.new
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       puts detail.to_s
       exit(23)
     end
   end
 end
diff --git a/lib/puppet/application/describe.rb b/lib/puppet/application/describe.rb
index e76b347f6..0c7bea96d 100644
--- a/lib/puppet/application/describe.rb
+++ b/lib/puppet/application/describe.rb
@@ -1,203 +1,256 @@
 require 'puppet/application'
 
 class Formatter
 
   def initialize(width)
     @width = width
   end
 
   def wrap(txt, opts)
     return "" unless txt && !txt.empty?
     work = (opts[:scrub] ? scrub(txt) : txt)
     indent = (opts[:indent] ? opts[:indent] : 0)
     textLen = @width - indent
     patt = Regexp.new("^(.{0,#{textLen}})[ \n]")
     prefix = " " * indent
 
     res = []
 
     while work.length > textLen
       if work =~ patt
         res << $1
         work.slice!(0, $MATCH.length)
       else
         res << work.slice!(0, textLen)
       end
     end
     res << work if work.length.nonzero?
     prefix + res.join("\n#{prefix}")
   end
 
   def header(txt, sep = "-")
     "\n#{txt}\n" + sep * txt.size
   end
 
   private
 
   def scrub(text)
     # For text with no carriage returns, there's nothing to do.
     return text if text !~ /\n/
     indent = nil
 
     # If we can match an indentation, then just remove that same level of
     # indent from every line.
     if text =~ /^(\s+)/
       indent = $1
       return text.gsub(/^#{indent}/,'')
     else
       return text
     end
   end
 
 end
 
 class TypeDoc
 
   def initialize
     @format = Formatter.new(76)
     @types = {}
     Puppet::Type.loadall
     Puppet::Type.eachtype { |type|
       next if type.name == :component
       @types[type.name] = type
     }
   end
 
   def list_types
     puts "These are the types known to puppet:\n"
     @types.keys.sort { |a, b|
       a.to_s <=> b.to_s
     }.each do |name|
       type = @types[name]
       s = type.doc.gsub(/\s+/, " ")
       n = s.index(".")
       if n.nil?
         s = ".. no documentation .."
       elsif n > 45
         s = s[0, 45] + " ..."
       else
         s = s[0, n]
       end
       printf "%-15s - %s\n", name, s
     end
   end
 
   def format_type(name, opts)
     name = name.to_sym
     unless @types.has_key?(name)
       puts "Unknown type #{name}"
       return
     end
     type = @types[name]
     puts @format.header(name.to_s, "=")
     puts @format.wrap(type.doc, :indent => 0, :scrub => true) + "\n\n"
 
     puts @format.header("Parameters")
     if opts[:parameters]
       format_attrs(type, [:property, :param])
     else
       list_attrs(type, [:property, :param])
     end
 
     if opts[:meta]
       puts @format.header("Meta Parameters")
       if opts[:parameters]
         format_attrs(type, [:meta])
       else
         list_attrs(type, [:meta])
       end
     end
 
     if type.providers.size > 0
       puts @format.header("Providers")
       if opts[:providers]
         format_providers(type)
       else
         list_providers(type)
       end
     end
   end
 
   # List details about attributes
   def format_attrs(type, attrs)
     docs = {}
     type.allattrs.each do |name|
       kind = type.attrtype(name)
       docs[name] = type.attrclass(name).doc if attrs.include?(kind) && name != :provider
     end
 
     docs.sort { |a,b|
       a[0].to_s <=> b[0].to_s
     }.each { |name, doc|
       print "\n- **#{name}**"
       if type.key_attributes.include?(name) and name != :name
         puts " (*namevar*)"
       else
         puts ""
       end
       puts @format.wrap(doc, :indent => 4, :scrub => true)
     }
   end
 
   # List the names of attributes
   def list_attrs(type, attrs)
     params = []
     type.allattrs.each do |name|
       kind = type.attrtype(name)
       params << name.to_s if attrs.include?(kind) && name != :provider
     end
     puts @format.wrap(params.sort.join(", "), :indent => 4)
   end
 
   def format_providers(type)
     type.providers.sort { |a,b|
       a.to_s <=> b.to_s
     }.each { |prov|
       puts "\n- **#{prov}**"
       puts @format.wrap(type.provider(prov).doc, :indent => 4, :scrub => true)
     }
   end
 
   def list_providers(type)
     list = type.providers.sort { |a,b|
       a.to_s <=> b.to_s
     }.join(", ")
     puts @format.wrap(list, :indent => 4)
   end
 
 end
 
 class Puppet::Application::Describe < Puppet::Application
   banner "puppet describe [options] [type]"
 
   should_not_parse_config
 
   option("--short", "-s", "Only list parameters without detail") do |arg|
     options[:parameters] = false
   end
 
   option("--providers","-p")
   option("--list", "-l")
   option("--meta","-m")
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+Print help about puppet types on the console. Run with '-h' to get
+detailed help.
+
+
+USAGE
+=====
+  puppet describe [-h|--help] [-s|--short] [-p|--providers] [-l|--list] [-m|--meta]
+
+
+DESCRIPTION
+===========
+Prints details of Puppet types, providers and metaparameters on the
+console.
+
+
+OPTIONS
+=======
+help:      Print this help text
+
+providers: Describe providers in detail for each type
+
+list:      List all types
+
+meta:      List all metaparameters
+
+short:     List only parameters without detail
+
+
+EXAMPLE
+=======
+  puppet describe --list
+  puppet describe file --providers
+  puppet describe user -s -m
+
+
+AUTHOR
+======
+David Lutterkort
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def preinit
     options[:parameters] = true
   end
 
   def main
     doc = TypeDoc.new
 
     if options[:list]
       doc.list_types
     else
       options[:types].each { |name| doc.format_type(name, options) }
     end
   end
 
   def setup
     options[:types] = command_line.args.dup
     handle_help(nil) unless options[:list] || options[:types].size > 0
     $stderr.puts "Warning: ignoring types when listing all types" if options[:list] && options[:types].size > 0
   end
 
 end
diff --git a/lib/puppet/application/doc.rb b/lib/puppet/application/doc.rb
index aaefd6e75..c7f270c8d 100644
--- a/lib/puppet/application/doc.rb
+++ b/lib/puppet/application/doc.rb
@@ -1,178 +1,262 @@
 require 'puppet/application'
 
 class Puppet::Application::Doc < Puppet::Application
 
   should_not_parse_config
   run_mode :master
 
   attr_accessor :unknown_args, :manifest
 
   def preinit
     {:references => [], :mode => :text, :format => :to_markdown }.each do |name,value|
       options[name] = value
     end
     @unknown_args = []
     @manifest = false
   end
 
   option("--all","-a")
   option("--outputdir OUTPUTDIR","-o")
   option("--verbose","-v")
   option("--debug","-d")
   option("--charset CHARSET")
 
   option("--format FORMAT", "-f") do |arg|
     method = "to_#{arg}"
     require 'puppet/util/reference'
     if Puppet::Util::Reference.method_defined?(method)
       options[:format] = method
     else
       raise "Invalid output format #{arg}"
     end
   end
 
   option("--mode MODE", "-m") do |arg|
     require 'puppet/util/reference'
     if Puppet::Util::Reference.modes.include?(arg) or arg.intern==:rdoc
       options[:mode] = arg.intern
     else
       raise "Invalid output mode #{arg}"
     end
   end
 
   option("--list", "-l") do |arg|
     require 'puppet/util/reference'
     puts Puppet::Util::Reference.references.collect { |r| Puppet::Util::Reference.reference(r).doc }.join("\n")
     exit(0)
   end
 
   option("--reference REFERENCE", "-r") do |arg|
     options[:references] << arg.intern
   end
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+Generate a reference for all Puppet types. Largely meant for internal
+Puppet Labs use.
+
+
+USAGE
+=====
+  puppet doc [-a|--all] [-h|--help] [-o|--outputdir <rdoc outputdir>] [-m|--mode <text|pdf|rdoc>]
+             [-r|--reference <[type]|configuration|..>] [--charset CHARSET] [manifest-file]
+
+
+DESCRIPTION
+===========
+If mode is not 'rdoc', then this command generates a Markdown document
+describing all installed Puppet types or all allowable arguments to
+puppet executables. It is largely meant for internal use and is used to
+generate the reference document available on the Puppet Labs web site.
+
+In 'rdoc' mode, this command generates an html RDoc hierarchy describing
+the manifests that are in 'manifestdir' and 'modulepath' configuration
+directives. The generated documentation directory is doc by default but
+can be changed with the 'outputdir' option.
+
+If the command is started with 'manifest-file' command-line arguments,
+puppet doc generate a single manifest documentation that is output on
+stdout.
+
+
+OPTIONS
+=======
+all:       Output the docs for all of the reference types. In 'rdoc'
+           modes, this also outputs documentation for all resources
+
+help:      Print this help message
+
+outputdir: Specifies the directory where to output the rdoc
+           documentation in 'rdoc' mode.
+
+mode:      Determine the output mode. Valid modes are 'text', 'pdf' and
+           'rdoc'. The 'pdf' mode creates PDF formatted files in the
+           /tmp directory. The default mode is 'text'. In 'rdoc' mode
+           you must provide 'manifests-path'
+
+reference: Build a particular reference. Get a list of references by
+           running 'puppet doc --list'.
+
+charset:   Used only in 'rdoc' mode. It sets the charset used in the
+           html files produced.
+
+
+EXAMPLE
+=======
+  $ puppet doc -r type > /tmp/type_reference.markdown
+
+or
+
+  $ puppet doc --outputdir /tmp/rdoc --mode rdoc /path/to/manifests
+
+or
+
+  $ puppet doc /etc/puppet/manifests/site.pp
+
+or
+
+  $ puppet doc -m pdf -r configuration
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005-2007 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def handle_unknown( opt, arg )
     @unknown_args << {:opt => opt, :arg => arg }
     true
   end
 
   def run_command
     return[:rdoc].include?(options[:mode]) ? send(options[:mode]) : other
   end
 
   def rdoc
     exit_code = 0
     files = []
     unless @manifest
       env = Puppet::Node::Environment.new
       files += env.modulepath
       files << File.dirname(env[:manifest])
     end
     files += command_line.args
     Puppet.info "scanning: #{files.inspect}"
 
           Puppet.settings.setdefaults(
         "puppetdoc",
 
       "document_all" => [false, "Document all resources"]
     )
     Puppet.settings[:document_all] = options[:all] || false
     begin
       require 'puppet/util/rdoc'
       if @manifest
         Puppet::Util::RDoc.manifestdoc(files)
       else
         options[:outputdir] = "doc" unless options[:outputdir]
         Puppet::Util::RDoc.rdoc(options[:outputdir], files, options[:charset])
       end
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       $stderr.puts "Could not generate documentation: #{detail}"
       exit_code = 1
     end
     exit exit_code
   end
 
   def other
     text = ""
     with_contents = options[:references].length <= 1
     exit_code = 0
     require 'puppet/util/reference'
     options[:references].sort { |a,b| a.to_s <=> b.to_s }.each do |name|
       raise "Could not find reference #{name}" unless section = Puppet::Util::Reference.reference(name)
 
       begin
         # Add the per-section text, but with no ToC
         text += section.send(options[:format], with_contents)
       rescue => detail
         puts detail.backtrace
         $stderr.puts "Could not generate reference #{name}: #{detail}"
         exit_code = 1
         next
       end
     end
 
     text += Puppet::Util::Reference.footer unless with_contents # We've only got one reference
 
     if options[:mode] == :pdf
       Puppet::Util::Reference.pdf(text)
     else
       puts text
     end
 
     exit exit_code
   end
 
   def setup
     # sole manifest documentation
     if command_line.args.size > 0
       options[:mode] = :rdoc
       @manifest = true
     end
 
     if options[:mode] == :rdoc
       setup_rdoc
     else
       setup_reference
     end
   end
 
   def setup_reference
     if options[:all]
       # Don't add dynamic references to the "all" list.
       require 'puppet/util/reference'
       options[:references] = Puppet::Util::Reference.references.reject do |ref|
         Puppet::Util::Reference.reference(ref).dynamic?
       end
     end
 
     options[:references] << :type if options[:references].empty?
   end
 
   def setup_rdoc(dummy_argument=:work_arround_for_ruby_GC_bug)
     # consume the unknown options
     # and feed them as settings
     if @unknown_args.size > 0
       @unknown_args.each do |option|
         # force absolute path for modulepath when passed on commandline
         if option[:opt]=="--modulepath" or option[:opt] == "--manifestdir"
           option[:arg] = option[:arg].split(':').collect { |p| File.expand_path(p) }.join(':')
         end
         Puppet.settings.handlearg(option[:opt], option[:arg])
       end
     end
 
     # Now parse the config
     Puppet.parse_config
 
     # Handle the logging settings.
     if options[:debug] or options[:verbose]
       if options[:debug]
         Puppet::Util::Log.level = :debug
       else
         Puppet::Util::Log.level = :info
       end
 
       Puppet::Util::Log.newdestination(:console)
     end
   end
 end
diff --git a/lib/puppet/application/filebucket.rb b/lib/puppet/application/filebucket.rb
index 9c3c79bc3..77ebbb843 100644
--- a/lib/puppet/application/filebucket.rb
+++ b/lib/puppet/application/filebucket.rb
@@ -1,87 +1,185 @@
 require 'puppet/application'
 
 class Puppet::Application::Filebucket < Puppet::Application
 
   should_not_parse_config
 
   option("--bucket BUCKET","-b")
   option("--debug","-d")
   option("--local","-l")
   option("--remote","-r")
   option("--verbose","-v")
 
   attr :args
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+A stand-alone Puppet filebucket client.
+
+
+USAGE
+=====
+  puppet filebucket [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
+     [-l|--local] [-r|--remote]
+     [-s|--server <server>] [-b|--bucket <directory>] <file> <file> ...
+
+
+DESCRIPTION
+===========
+This is a stand-alone filebucket client for sending files to a local or
+central filebucket.
+
+
+USAGE
+=====
+This client can operate in three modes, with only one mode per call:
+
+backup:  Send one or more files to the specified file bucket. Each sent
+         file is printed with its resulting md5 sum.
+
+get:     Return the text associated with an md5 sum. The text is printed
+         to stdout, and only one file can be retrieved at a time.
+
+restore: Given a file path and an md5 sum, store the content associated
+         with the sum into the specified file path. You can specify an
+         entirely new path to this argument; you are not restricted to
+
+Note that 'filebucket' defaults to using a network-based filebucket
+available on the server named 'puppet'. To use this, you'll have to be
+running as a user with valid Puppet certificates. Alternatively, you can
+use your local file bucket by specifying '--local'.
+
+
+EXAMPLE
+=======
+  $ puppet filebucket backup /etc/passwd
+  /etc/passwd: 429b225650b912a2ee067b0a4cf1e949
+  $ puppet filebucket restore /tmp/passwd 429b225650b912a2ee067b0a4cf1e949
+  $
+
+
+OPTIONS
+=======
+Note that any configuration parameter that's valid in the configuration
+file is also a valid long argument. For example, 'ssldir' is a valid
+configuration parameter, so you can specify '--ssldir <directory>' as an
+argument.
+
+See the configuration file documentation at
+http://docs.puppetlabs.com/references/stable/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet with
+'--genconfig'.
+
+debug:   Enable full debugging.
+
+help:    Print this help message
+
+local:   Use the local filebucket. This will use the default
+         configuration information.
+
+remote:  Use a remote filebucket. This will use the default
+         configuration information.
+
+server:  The server to send the file to, instead of locally.
+
+verbose: Print extra information.
+
+version: Print version information.
+
+
+EXAMPLE
+=======
+  puppet filebucket -b /tmp/filebucket /my/file
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
+
   def run_command
     @args = command_line.args
     command = args.shift
     return send(command) if %w{get backup restore}.include? command
     help
   end
 
   def get
     md5 = args.shift
     out = @client.getfile(md5)
     print out
   end
 
   def backup
     args.each do |file|
       unless FileTest.exists?(file)
         $stderr.puts "#{file}: no such file"
         next
       end
       unless FileTest.readable?(file)
         $stderr.puts "#{file}: cannot read file"
         next
       end
       md5 = @client.backup(file)
       puts "#{file}: #{md5}"
     end
   end
 
   def restore
     file = args.shift
     md5 = args.shift
     @client.restore(file, md5)
   end
 
   def setup
     Puppet::Log.newdestination(:console)
 
     @client = nil
     @server = nil
 
     trap(:INT) do
       $stderr.puts "Cancelling"
       exit(1)
     end
 
     if options[:debug]
       Puppet::Log.level = :debug
     elsif options[:verbose]
       Puppet::Log.level = :info
     end
 
     # Now parse the config
     Puppet.parse_config
 
       exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     require 'puppet/file_bucket/dipper'
     begin
       if options[:local] or options[:bucket]
         path = options[:bucket] || Puppet[:bucketdir]
         @client = Puppet::FileBucket::Dipper.new(:Path => path)
       else
         @client = Puppet::FileBucket::Dipper.new(:Server => Puppet[:server])
       end
     rescue => detail
       $stderr.puts detail
       puts detail.backtrace if Puppet[:trace]
       exit(1)
     end
   end
 
 end
 
diff --git a/lib/puppet/application/inspect.rb b/lib/puppet/application/inspect.rb
index 19324e285..599898a07 100644
--- a/lib/puppet/application/inspect.rb
+++ b/lib/puppet/application/inspect.rb
@@ -1,123 +1,176 @@
 require 'puppet'
 require 'puppet/application'
 require 'puppet/file_bucket/dipper'
 
 class Puppet::Application::Inspect < Puppet::Application
 
   should_parse_config
   run_mode :agent
 
   option("--debug","-d")
   option("--verbose","-v")
 
   option("--logdest LOGDEST", "-l") do |arg|
     begin
       Puppet::Util::Log.newdestination(arg)
       options[:logset] = true
     rescue => detail
       $stderr.puts detail.to_s
     end
   end
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+
+Prepare and submit an inspection report to the puppet master.
+
+
+USAGE
+=====
+
+  puppet inspect
+
+
+DESCRIPTION
+===========
+
+This command uses the cached catalog from the previous run of 'puppet
+agent' to determine which attributes of which resources have been
+marked as auditable with the 'audit' metaparameter. It then examines
+the current state of the system, writes the state of the specified
+resource attributes to a report, and submits the report to the puppet
+master.
+
+Puppet inspect does not run as a daemon, and must be run manually or from cron.
+
+
+OPTIONS
+=======
+
+Any configuration setting which is valid in the configuration file is
+also a valid long argument, e.g. '--server=master.domain.com'. See the
+configuration file documentation at
+http://docs.puppetlabs.com/references/latest/configuration.html for
+the full list of acceptable settings.
+
+
+AUTHOR
+======
+
+Puppet Labs
+
+
+COPYRIGHT
+=========
+
+Copyright (c) 2011 Puppet Labs, LLC
+Licensed under the GNU General Public License version 2
+
+    HELP
+  end
+
   def setup
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     raise "Inspect requires reporting to be enabled. Set report=true in puppet.conf to enable reporting." unless Puppet[:report]
 
     @report = Puppet::Transaction::Report.new("inspect")
 
     Puppet::Util::Log.newdestination(@report)
     Puppet::Util::Log.newdestination(:console) unless options[:logset]
 
     trap(:INT) do
       $stderr.puts "Exiting"
       exit(1)
     end
 
     if options[:debug]
       Puppet::Util::Log.level = :debug
     elsif options[:verbose]
       Puppet::Util::Log.level = :info
     end
 
     Puppet::Transaction::Report.indirection.terminus_class = :rest
     Puppet::Resource::Catalog.indirection.terminus_class = :yaml
   end
 
   def run_command
     retrieval_starttime = Time.now
 
     unless catalog = Puppet::Resource::Catalog.indirection.find(Puppet[:certname])
       raise "Could not find catalog for #{Puppet[:certname]}"
     end
 
     @report.configuration_version = catalog.version
 
     inspect_starttime = Time.now
     @report.add_times("config_retrieval", inspect_starttime - retrieval_starttime)
 
     if Puppet[:archive_files]
       dipper = Puppet::FileBucket::Dipper.new(:Server => Puppet[:archive_file_server])
     end
 
     catalog.to_ral.resources.each do |ral_resource|
       audited_attributes = ral_resource[:audit]
       next unless audited_attributes
 
       status = Puppet::Resource::Status.new(ral_resource)
 
       begin
         audited_resource = ral_resource.to_resource
       rescue StandardError => detail
         puts detail.backtrace if Puppet[:trace]
         ral_resource.err "Could not inspect #{ral_resource}; skipping: #{detail}"
         audited_attributes.each do |name|
           event = ral_resource.event(
             :property => name,
             :status   => "failure",
             :audited  => true,
             :message  => "failed to inspect #{name}"
           )
           status.add_event(event)
         end
       else
         audited_attributes.each do |name|
           next if audited_resource[name].nil?
           # Skip :absent properties of :absent resources. Really, it would be nicer if the RAL returned nil for those, but it doesn't. ~JW
           if name == :ensure or audited_resource[:ensure] != :absent or audited_resource[name] != :absent
             event = ral_resource.event(
               :previous_value => audited_resource[name],
               :property       => name,
               :status         => "audit",
               :audited        => true,
               :message        => "inspected value is #{audited_resource[name].inspect}"
             )
             status.add_event(event)
           end
         end
       end
       if Puppet[:archive_files] and ral_resource.type == :file and audited_attributes.include?(:content)
         path = ral_resource[:path]
         if File.readable?(path)
           begin
             dipper.backup(path)
           rescue StandardError => detail
             Puppet.warning detail
           end
         end
       end
       @report.add_resource_status(status)
     end
 
     finishtime = Time.now
     @report.add_times("inspect", finishtime - inspect_starttime)
     @report.finalize_report
 
     begin
       Puppet::Transaction::Report.indirection.save(@report)
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       Puppet.err "Could not send report: #{detail}"
     end
   end
 end
diff --git a/lib/puppet/application/kick.rb b/lib/puppet/application/kick.rb
index 12dad653a..4cf06036f 100644
--- a/lib/puppet/application/kick.rb
+++ b/lib/puppet/application/kick.rb
@@ -1,212 +1,343 @@
 require 'puppet/application'
 
 class Puppet::Application::Kick < Puppet::Application
 
   should_not_parse_config
 
   attr_accessor :hosts, :tags, :classes
 
   option("--all","-a")
   option("--foreground","-f")
   option("--debug","-d")
   option("--ping","-P")
   option("--test")
 
   option("--host HOST") do |arg|
     @hosts << arg
   end
 
   option("--tag TAG", "-t") do |arg|
     @tags << arg
   end
 
   option("--class CLASS", "-c") do |arg|
     @classes << arg
   end
 
   option("--no-fqdn", "-n") do |arg|
     options[:fqdn] = false
   end
 
   option("--parallel PARALLEL", "-p") do |arg|
     begin
       options[:parallel] = Integer(arg)
     rescue
       $stderr.puts "Could not convert #{arg.inspect} to an integer"
       exit(23)
     end
   end
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+Trigger a puppet agent run on a set of hosts.
+
+
+USAGE
+=====
+  puppet kick [-a|--all] [-c|--class <class>] [-d|--debug] [-f|--foreground]
+      [-h|--help] [--host <host>] [--no-fqdn] [--ignoreschedules]
+      [-t|--tag <tag>] [--test] [-p|--ping] <host> [<host> [...]]
+
+
+DESCRIPTION
+===========
+This script can be used to connect to a set of machines running 'puppet
+agent' and trigger them to run their configurations. The most common
+usage would be to specify a class of hosts and a set of tags, and
+'puppet kick' would look up in LDAP all of the hosts matching that
+class, then connect to each host and trigger a run of all of the objects
+with the specified tags.
+
+If you are not storing your host configurations in LDAP, you can specify
+hosts manually.
+
+You will most likely have to run 'puppet kick' as root to get access to
+the SSL certificates.
+
+'puppet kick' reads 'puppet master''s configuration file, so that it can
+copy things like LDAP settings.
+
+
+USAGE NOTES
+===========
+'puppet kick' is useless unless 'puppet agent' is listening. See its
+documentation for more information, but the gist is that you must enable
+'listen' on the 'puppet agent' daemon, either using '--listen' on the
+command line or adding 'listen: true' in its config file. In addition,
+you need to set the daemons up to specifically allow connections by
+creating the 'namespaceauth' file, normally at
+'/etc/puppet/namespaceauth.conf'. This file specifies who has access to
+each namespace; if you create the file you must add every namespace you
+want any Puppet daemon to allow -- it is currently global to all Puppet
+daemons.
+
+An example file looks like this::
+
+    [fileserver]
+        allow *.madstop.com
+
+    [puppetmaster]
+        allow *.madstop.com
+
+    [puppetrunner]
+        allow culain.madstop.com
+
+This is what you would install on your Puppet master; non-master hosts
+could leave off the 'fileserver' and 'puppetmaster' namespaces.
+
+
+OPTIONS
+=======
+Note that any configuration parameter that's valid in the configuration
+file is also a valid long argument. For example, 'ssldir' is a valid
+configuration parameter, so you can specify '--ssldir <directory>' as an
+argument.
+
+See the configuration file documentation at
+http://reductivelabs.com/projects/puppet/reference/configref.html for
+the full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet master
+with '--genconfig'.
+
+all:             Connect to all available hosts. Requires LDAP support
+                 at this point.
+
+class:           Specify a class of machines to which to connect. This
+                 only works if you have LDAP configured, at the moment.
+
+debug:           Enable full debugging.
+
+foreground:      Run each configuration in the foreground; that is, when
+                 connecting to a host, do not return until the host has
+                 finished its run. The default is false.
+
+help:            Print this help message
+
+host:            A specific host to which to connect. This flag can be
+                 specified more than once.
+
+ignoreschedules: Whether the client should ignore schedules when running
+                 its configuration. This can be used to force the client
+                 to perform work it would not normally perform so soon.
+                 The default is false.
+
+parallel:        How parallel to make the connections. Parallelization
+                 is provided by forking for each client to which to
+                 connect. The default is 1, meaning serial execution.
+
+tag:             Specify a tag for selecting the objects to apply. Does
+                 not work with the --test option.
+
+test:            Print the hosts you would connect to but do not
+                 actually connect. This option requires LDAP support at
+                 this point.
+
+ping::
+
+  Do a ICMP echo against the target host. Skip hosts that don't respond to ping.
+
+
+EXAMPLE
+=======
+  sudo puppet kick -p 10 -t remotefile -t webserver host1 host2
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def run_command
     @hosts += command_line.args
     options[:test] ? test : main
   end
 
   def test
     puts "Skipping execution in test mode"
     exit(0)
   end
 
   def main
     require 'puppet/network/client'
 
     Puppet.warning "Failed to load ruby LDAP library. LDAP functionality will not be available" unless Puppet.features.ldap?
     require 'puppet/util/ldap/connection'
 
     todo = @hosts.dup
 
     failures = []
 
     # Now do the actual work
     go = true
     while go
       # If we don't have enough children in process and we still have hosts left to
       # do, then do the next host.
       if @children.length < options[:parallel] and ! todo.empty?
         host = todo.shift
         pid = fork do
           run_for_host(host)
         end
         @children[pid] = host
       else
         # Else, see if we can reap a process.
         begin
           pid = Process.wait
 
           if host = @children[pid]
             # Remove our host from the list of children, so the parallelization
             # continues working.
             @children.delete(pid)
             failures << host if $CHILD_STATUS.exitstatus != 0
             print "#{host} finished with exit code #{$CHILD_STATUS.exitstatus}\n"
           else
             $stderr.puts "Could not find host for PID #{pid} with status #{$CHILD_STATUS.exitstatus}"
           end
         rescue Errno::ECHILD
           # There are no children left, so just exit unless there are still
           # children left to do.
           next unless todo.empty?
 
           if failures.empty?
             puts "Finished"
             exit(0)
           else
             puts "Failed: #{failures.join(", ")}"
             exit(3)
           end
         end
       end
     end
   end
 
   def run_for_host(host)
     if options[:ping]
       out = %x{ping -c 1 #{host}}
       unless $CHILD_STATUS == 0
         $stderr.print "Could not contact #{host}\n"
         next
       end
     end
 
     require 'puppet/run'
     Puppet::Run.indirection.terminus_class = :rest
     port = Puppet[:puppetport]
     url = ["https://#{host}:#{port}", "production", "run", host].join('/')
 
     print "Triggering #{host}\n"
     begin
       run_options = {
         :tags => @tags,
         :background => ! options[:foreground],
         :ignoreschedules => options[:ignoreschedules]
       }
       run = Puppet::Run.indirection.save(Puppet::Run.new( run_options ), url)
       puts "Getting status"
       result = run.status
       puts "status is #{result}"
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       $stderr.puts "Host #{host} failed: #{detail}\n"
       exit(2)
     end
 
     case result
     when "success";
       exit(0)
     when "running"
       $stderr.puts "Host #{host} is already running"
       exit(3)
     else
       $stderr.puts "Host #{host} returned unknown answer '#{result}'"
       exit(12)
     end
   end
 
   def initialize(*args)
     super
     @hosts = []
     @classes = []
     @tags = []
   end
 
   def preinit
     [:INT, :TERM].each do |signal|
       trap(signal) do
         $stderr.puts "Cancelling"
         exit(1)
       end
     end
     options[:parallel] = 1
     options[:verbose] = true
     options[:fqdn] = true
     options[:ignoreschedules] = false
     options[:foreground] = false
   end
 
   def setup
     if options[:debug]
       Puppet::Util::Log.level = :debug
     else
       Puppet::Util::Log.level = :info
     end
 
     # Now parse the config
     Puppet.parse_config
 
     if Puppet[:node_terminus] == "ldap" and (options[:all] or @classes)
       if options[:all]
         @hosts = Puppet::Node.indirection.search("whatever", :fqdn => options[:fqdn]).collect { |node| node.name }
         puts "all: #{@hosts.join(", ")}"
       else
         @hosts = []
         @classes.each do |klass|
           list = Puppet::Node.indirection.search("whatever", :fqdn => options[:fqdn], :class => klass).collect { |node| node.name }
           puts "#{klass}: #{list.join(", ")}"
 
           @hosts += list
         end
       end
     elsif ! @classes.empty?
       $stderr.puts "You must be using LDAP to specify host classes"
       exit(24)
     end
 
     @children = {}
 
     # If we get a signal, then kill all of our children and get out.
     [:INT, :TERM].each do |signal|
       trap(signal) do
         Puppet.notice "Caught #{signal}; shutting down"
         @children.each do |pid, host|
           Process.kill("INT", pid)
         end
 
         waitall
 
         exit(1)
       end
     end
 
   end
 
 end
diff --git a/lib/puppet/application/master.rb b/lib/puppet/application/master.rb
index 879b66c67..b2b77f870 100644
--- a/lib/puppet/application/master.rb
+++ b/lib/puppet/application/master.rb
@@ -1,153 +1,230 @@
 require 'puppet/application'
 
 class Puppet::Application::Master < Puppet::Application
 
   should_parse_config
   run_mode :master
 
   option("--debug", "-d")
   option("--verbose", "-v")
 
   # internal option, only to be used by ext/rack/config.ru
   option("--rack")
 
   option("--compile host",  "-c host") do |arg|
     options[:node] = arg
   end
 
   option("--logdest DEST",  "-l DEST") do |arg|
     begin
       Puppet::Util::Log.newdestination(arg)
       options[:setdest] = true
     rescue => detail
       puts detail.backtrace if Puppet[:debug]
       $stderr.puts detail.to_s
     end
   end
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+The central puppet server. Functions as a certificate authority by
+default.
+
+
+USAGE
+=====
+  puppet master [-D|--daemonize|--no-daemonize] [-d|--debug] [-h|--help]
+      [-l|--logdest <file>|console|syslog] [-v|--verbose] [-V|--version]
+      [--compile <nodename>] [--apply <catalog>]
+
+DESCRIPTION
+===========
+This is the puppet central daemon.
+
+
+OPTIONS
+=======
+Note that any configuration parameter that's valid in the configuration
+file is also a valid long argument. For example, 'ssldir' is a valid
+configuration parameter, so you can specify '--ssldir <directory>' as an
+argument.
+
+See the configuration file documentation at
+http://docs.puppetlabs.com/references/stable/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppetmasterdd
+with '--genconfig'.
+
+daemonize:    Send the process into the background. This is the default.
+
+no-daemonize: Do not send the process into the background.
+
+debug:        Enable full debugging.
+
+help:         Print this help message.
+
+logdest:      Where to send messages. Choose between syslog, the
+              console, and a log file. Defaults to sending messages to
+              syslog, or the console if debugging or verbosity is
+              enabled.
+
+verbose:      Enable verbosity.
+
+version:      Print the puppet version number and exit.
+
+compile:      Capability to compile a catalogue and output it in JSON
+              from the Puppet master. Uses facts contained in the
+              $vardir/yaml/ directory to compile the catalog.
+
+apply:        Capability to apply JSON catalog (such as one generated
+              with --compile). You can either specify a JSON file or
+              pipe in JSON from standard input.
+
+
+EXAMPLE
+=======
+  puppet master
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def preinit
     trap(:INT) do
       $stderr.puts "Cancelling startup"
       exit(0)
     end
 
     # Create this first-off, so we have ARGV
     require 'puppet/daemon'
     @daemon = Puppet::Daemon.new
     @daemon.argv = ARGV.dup
   end
 
   def run_command
     if options[:node]
       compile
     elsif Puppet[:parseonly]
       parseonly
     else
       main
     end
   end
 
   def compile
     Puppet::Util::Log.newdestination :console
     raise ArgumentError, "Cannot render compiled catalogs without pson support" unless Puppet.features.pson?
     begin
       unless catalog = Puppet::Resource::Catalog.indirection.find(options[:node])
         raise "Could not compile catalog for #{options[:node]}"
       end
 
       jj catalog.to_resource
     rescue => detail
       $stderr.puts detail
       exit(30)
     end
     exit(0)
   end
 
   def parseonly
     begin
       Puppet::Node::Environment.new(Puppet[:environment]).known_resource_types
     rescue => detail
       Puppet.err detail
       exit 1
     end
     exit(0)
   end
 
   def main
     require 'etc'
     require 'puppet/file_serving/content'
     require 'puppet/file_serving/metadata'
 
     xmlrpc_handlers = [:Status, :FileServer, :Master, :Report, :Filebucket]
 
     xmlrpc_handlers << :CA if Puppet[:ca]
 
     # Make sure we've got a localhost ssl cert
     Puppet::SSL::Host.localhost
 
     # And now configure our server to *only* hit the CA for data, because that's
     # all it will have write access to.
     Puppet::SSL::Host.ca_location = :only if Puppet::SSL::CertificateAuthority.ca?
 
     if Puppet.features.root?
       begin
         Puppet::Util.chuser
       rescue => detail
         puts detail.backtrace if Puppet[:trace]
         $stderr.puts "Could not change user to #{Puppet[:user]}: #{detail}"
         exit(39)
       end
     end
 
     unless options[:rack]
       require 'puppet/network/server'
       @daemon.server = Puppet::Network::Server.new(:xmlrpc_handlers => xmlrpc_handlers)
       @daemon.daemonize if Puppet[:daemonize]
     else
       require 'puppet/network/http/rack'
       @app = Puppet::Network::HTTP::Rack.new(:xmlrpc_handlers => xmlrpc_handlers, :protocols => [:rest, :xmlrpc])
     end
 
     Puppet.notice "Starting Puppet master version #{Puppet.version}"
 
     unless options[:rack]
       @daemon.start
     else
       return @app
     end
   end
 
   def setup
     # Handle the logging settings.
     if options[:debug] or options[:verbose]
       if options[:debug]
         Puppet::Util::Log.level = :debug
       else
         Puppet::Util::Log.level = :info
       end
 
       unless Puppet[:daemonize] or options[:rack]
         Puppet::Util::Log.newdestination(:console)
         options[:setdest] = true
       end
     end
 
     Puppet::Util::Log.newdestination(:syslog) unless options[:setdest]
 
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     Puppet.settings.use :main, :master, :ssl
 
     # Cache our nodes in yaml.  Currently not configurable.
     Puppet::Node.indirection.cache_class = :yaml
 
     # Configure all of the SSL stuff.
     if Puppet::SSL::CertificateAuthority.ca?
       Puppet::SSL::Host.ca_location = :local
       Puppet.settings.use :ca
       Puppet::SSL::CertificateAuthority.instance
     else
       Puppet::SSL::Host.ca_location = :none
     end
   end
 end
diff --git a/lib/puppet/application/queue.rb b/lib/puppet/application/queue.rb
index b9e8ca4ca..d32ec9a6f 100644
--- a/lib/puppet/application/queue.rb
+++ b/lib/puppet/application/queue.rb
@@ -1,92 +1,151 @@
 require 'puppet/application'
 require 'puppet/util'
 
 class Puppet::Application::Queue < Puppet::Application
   should_parse_config
 
   attr_accessor :daemon
 
   def preinit
     require 'puppet/daemon'
     @daemon = Puppet::Daemon.new
     @daemon.argv = ARGV.dup
     Puppet::Util::Log.newdestination(:console)
 
     # Do an initial trap, so that cancels don't get a stack trace.
 
     # This exits with exit code 1
     trap(:INT) do
       $stderr.puts "Caught SIGINT; shutting down"
       exit(1)
     end
 
     # This is a normal shutdown, so code 0
     trap(:TERM) do
       $stderr.puts "Caught SIGTERM; shutting down"
       exit(0)
     end
 
     {
       :verbose => false,
       :debug => false
     }.each do |opt,val|
       options[opt] = val
     end
   end
 
   option("--debug","-d")
   option("--verbose","-v")
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+Retrieve serialized records from a queue and process them in order.
+
+
+USAGE
+=====
+  puppet queue [-d|--debug] [-v|--verbose]
+
+
+DESCRIPTION
+===========
+This is a simple application that just processes entities in a queue as
+they are recieved.
+
+
+OPTIONS
+=======
+Note that any configuration parameter that's valid in the configuration
+file is also a valid long argument. For example, 'server' is a valid
+configuration parameter, so you can specify '--server <servername>' as
+an argument.
+
+See the configuration file documentation at
+http://docs.puppetlabs.com/references/stable/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppetd with
+'--genconfig'.
+
+debug:   Enable full debugging.
+
+help:    Print this help message
+
+verbose: Turn on verbose reporting.
+
+version: Print the puppet version number and exit.
+
+
+EXAMPLE
+=======
+  puppet queue
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2009 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def main
     require 'puppet/indirector/catalog/queue' # provides Puppet::Indirector::Queue.subscribe
     Puppet.notice "Starting puppetqd #{Puppet.version}"
     Puppet::Resource::Catalog::Queue.subscribe do |catalog|
       # Once you have a Puppet::Resource::Catalog instance, passing it to save should suffice
       # to put it through to the database via its active_record indirector (which is determined
       # by the terminus_class = :active_record setting above)
       Puppet::Util.benchmark(:notice, "Processing queued catalog for #{catalog.name}") do
         begin
           Puppet::Resource::Catalog.indirection.save(catalog)
         rescue => detail
           puts detail.backtrace if Puppet[:trace]
           Puppet.err "Could not save queued catalog for #{catalog.name}: #{detail}"
         end
       end
     end
 
     Thread.list.each { |thread| thread.join }
   end
 
   # Handle the logging settings.
   def setup_logs
     if options[:debug] or options[:verbose]
       Puppet::Util::Log.newdestination(:console)
       if options[:debug]
         Puppet::Util::Log.level = :debug
       else
         Puppet::Util::Log.level = :info
       end
     end
   end
 
   def setup
     unless Puppet.features.stomp?
       raise ArgumentError, "Could not load the 'stomp' library, which must be present for queueing to work.  You must install the required library."
     end
 
     setup_logs
 
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     require 'puppet/resource/catalog'
     Puppet::Resource::Catalog.indirection.terminus_class = :active_record
 
     daemon.daemonize if Puppet[:daemonize]
 
     # We want to make sure that we don't have a cache
     # class set up, because if storeconfigs is enabled,
     # we'll get a loop of continually caching the catalog
     # for storage again.
     Puppet::Resource::Catalog.indirection.cache_class = nil
   end
 end
diff --git a/lib/puppet/application/resource.rb b/lib/puppet/application/resource.rb
index c7c1c28be..a0e33408d 100644
--- a/lib/puppet/application/resource.rb
+++ b/lib/puppet/application/resource.rb
@@ -1,118 +1,222 @@
 require 'puppet/application'
 
 class Puppet::Application::Resource < Puppet::Application
 
   should_not_parse_config
 
   attr_accessor :host, :extra_params
 
   def preinit
     @extra_params = []
     @host = nil
     Facter.loadfacts
   end
 
   option("--debug","-d")
   option("--verbose","-v")
   option("--edit","-e")
 
   option("--host HOST","-H") do |arg|
     @host = arg
   end
 
   option("--types", "-t") do |arg|
     types = []
     Puppet::Type.loadall
     Puppet::Type.eachtype do |t|
       next if t.name == :component
       types << t.name.to_s
     end
     puts types.sort
     exit
   end
 
   option("--param PARAM", "-p") do |arg|
     @extra_params << arg.to_sym
   end
 
+  def help
+    <<-HELP
+
+SYNOPSIS
+========
+Use the Puppet RAL to directly interact with the system.
+
+
+USAGE
+=====
+  puppet resource [-h|--help] [-d|--debug] [-v|--verbose] [-e|--edit]
+                  [-H|--host <host>] [-p|--param <param>] [-t|--types]
+                  type <name>
+
+
+DESCRIPTION
+===========
+This command provides simple facilities for converting current system
+state into Puppet code, along with some ability to use Puppet to affect
+the current state.
+
+By default, you must at least provide a type to list, which case puppet
+resource will tell you everything it knows about all instances of that
+type. You can optionally specify an instance name, and puppet resource
+will only describe that single instance.
+
+You can also add '--edit' as an argument, and puppet resource will write
+its output to a file, open that file in an editor, and then apply the
+file as a Puppet transaction. You can easily use this to use Puppet to
+make simple changes to a system.
+
+
+OPTIONS
+=======
+Note that any configuration parameter that's valid in the configuration
+file is also a valid long argument. For example, 'ssldir' is a valid
+configuration parameter, so you can specify '--ssldir <directory>' as an
+argument.
+
+See the configuration file documentation at
+http://docs.puppetlabs.com/references/stable/configuration.html for the
+full list of acceptable parameters. A commented list of all
+configuration options can also be generated by running puppet with
+'--genconfig'.
+
+debug: Enable full debugging.
+
+edit:
+
+  Write the results of the query to a file, open the file in an editor,
+  and read the file back in as an executable Puppet manifest.
+
+host:
+
+  When specified, connect to the resource server on the named host
+  and retrieve the list of resouces of the type specified.
+
+help:
+
+  Print this help message.
+
+param:
+
+  Add more parameters to be outputted from queries.
+
+types:
+
+  List all available types.
+
+verbose:
+
+  Print extra information.
+
+
+EXAMPLE
+=======
+This example uses `puppet resource` to return Puppet configuration for
+the user `luke`:
+
+     $ puppet resource user luke
+     user { 'luke':
+       home => '/home/luke',
+       uid => '100',
+       ensure => 'present',
+       comment => 'Luke Kanies,,,',
+       gid => '1000',
+       shell => '/bin/bash',
+       groups => ['sysadmin','audio','video','puppet']
+     }
+
+
+AUTHOR
+======
+Luke Kanies
+
+
+COPYRIGHT
+=========
+Copyright (c) 2005-2007 Puppet Labs, LLC Licensed under the GNU Public
+License
+
+    HELP
+  end
+
   def main
     args = command_line.args
     type = args.shift or raise "You must specify the type to display"
     typeobj = Puppet::Type.type(type) or raise "Could not find type #{type}"
     name = args.shift
     params = {}
     args.each do |setting|
       if setting =~ /^(\w+)=(.+)$/
         params[$1] = $2
       else
         raise "Invalid parameter setting #{setting}"
       end
     end
 
     raise "You cannot edit a remote host" if options[:edit] and @host
 
     properties = typeobj.properties.collect { |s| s.name }
 
     format = proc {|trans|
       trans.dup.collect do |param, value|
         if value.nil? or value.to_s.empty?
           trans.delete(param)
         elsif value.to_s == "absent" and param.to_s != "ensure"
           trans.delete(param)
         end
 
         trans.delete(param) unless properties.include?(param) or @extra_params.include?(param)
       end
       trans.to_manifest
     }
 
     if @host
       Puppet::Resource.indirection.terminus_class = :rest
       port = Puppet[:puppetport]
       key = ["https://#{host}:#{port}", "production", "resources", type, name].join('/')
     else
       key = [type, name].join('/')
     end
 
     text = if name
       if params.empty?
         [ Puppet::Resource.indirection.find( key ) ]
       else
         [ Puppet::Resource.indirection.save(Puppet::Resource.new( type, name, :parameters => params ), key) ]
       end
     else
       Puppet::Resource.indirection.search( key, {} )
     end.map(&format).join("\n")
 
     if options[:edit]
       file = "/tmp/x2puppet-#{Process.pid}.pp"
       begin
         File.open(file, "w") do |f|
           f.puts text
         end
         ENV["EDITOR"] ||= "vi"
         system(ENV["EDITOR"], file)
         system("puppet -v #{file}")
       ensure
         #if FileTest.exists? file
         #    File.unlink(file)
         #end
       end
     else
       puts text
     end
   end
 
   def setup
     Puppet::Util::Log.newdestination(:console)
 
     # Now parse the config
     Puppet.parse_config
 
     if options[:debug]
       Puppet::Util::Log.level = :debug
     elsif options[:verbose]
       Puppet::Util::Log.level = :info
     end
   end
 end
diff --git a/lib/puppet/defaults.rb b/lib/puppet/defaults.rb
index e3b86bca4..576acfeb6 100644
--- a/lib/puppet/defaults.rb
+++ b/lib/puppet/defaults.rb
@@ -1,821 +1,825 @@
 # The majority of the system configuration parameters are set in this file.
 module Puppet
   setdefaults(:main,
     :confdir => [Puppet.run_mode.conf_dir, "The main Puppet configuration directory.  The default for this parameter is calculated based on the user.  If the process
     is running as root or the user that Puppet is supposed to run as, it defaults to a system directory, but if it's running as any other user,
     it defaults to being in the user's home directory."],
     :vardir => [Puppet.run_mode.var_dir, "Where Puppet stores dynamic and growing data.  The default for this parameter is calculated specially, like `confdir`_."],
     :name => [Puppet.application_name.to_s, "The name of the application, if we are running as one.  The
       default is essentially $0 without the path or `.rb`."],
     :run_mode => [Puppet.run_mode.name.to_s, "The effective 'run mode' of the application: master, agent, or user."]
   )
 
   setdefaults(:main, :logdir => Puppet.run_mode.logopts)
 
   setdefaults(:main,
     :trace => [false, "Whether to print stack traces on some errors"],
-    :autoflush => [false, "Whether log files should always flush to disk."],
+    :autoflush => {
+      :default => false,
+      :desc    => "Whether log files should always flush to disk.",
+      :hook    => proc { |value| Log.autoflush = value }
+    },
     :syslogfacility => ["daemon", "What syslog facility to use when logging to
       syslog.  Syslog has a fixed list of valid facilities, and you must
       choose one of those; you cannot just make one up."],
     :statedir => { :default => "$vardir/state",
       :mode => 01755,
       :desc => "The directory where Puppet state is stored.  Generally,
         this directory can be removed without causing harm (although it
         might result in spurious service restarts)."
     },
     :rundir => {
       :default => Puppet.run_mode.run_dir,
       :mode => 01777,
       :desc => "Where Puppet PID files are kept."
     },
     :genconfig => [false,
       "Whether to just print a configuration to stdout and exit.  Only makes
       sense when used interactively.  Takes into account arguments specified
       on the CLI."],
     :genmanifest => [false,
       "Whether to just print a manifest to stdout and exit.  Only makes
       sense when used interactively.  Takes into account arguments specified
       on the CLI."],
     :configprint => ["",
       "Print the value of a specific configuration parameter.  If a
       parameter is provided for this, then the value is printed and puppet
       exits.  Comma-separate multiple values.  For a list of all values,
       specify 'all'.  This feature is only available in Puppet versions
       higher than 0.18.4."],
     :color => ["ansi", "Whether to use colors when logging to the console.
       Valid values are `ansi` (equivalent to `true`), `html` (mostly
       used during testing with TextMate), and `false`, which produces
       no color."],
     :mkusers => [false,
       "Whether to create the necessary user and group that puppet agent will
       run as."],
     :manage_internal_file_permissions => [true,
       "Whether Puppet should manage the owner, group, and mode of files
       it uses internally"
       ],
     :onetime => {:default => false,
       :desc => "Run the configuration once, rather than as a long-running
       daemon. This is useful for interactively running puppetd.",
       :short => 'o'
       },
     :path => {:default => "none",
       :desc => "The shell search path.  Defaults to whatever is inherited
         from the parent process.",
       :call_on_define => true, # Call our hook with the default value, so we always get the libdir set.
       :hook => proc do |value|
         ENV["PATH"] = "" if ENV["PATH"].nil?
         ENV["PATH"] = value unless value == "none"
         paths = ENV["PATH"].split(File::PATH_SEPARATOR)
         %w{/usr/sbin /sbin}.each do |path|
           ENV["PATH"] += File::PATH_SEPARATOR + path unless paths.include?(path)
         end
         value
       end
     },
     :libdir => {:default => "$vardir/lib",
       :desc => "An extra search path for Puppet.  This is only useful
         for those files that Puppet will load on demand, and is only
         guaranteed to work for those cases.  In fact, the autoload
         mechanism is responsible for making sure this directory
         is in Ruby's search path",
       :call_on_define => true, # Call our hook with the default value, so we always get the libdir set.
       :hook => proc do |value|
         $LOAD_PATH.delete(@oldlibdir) if defined?(@oldlibdir) and $LOAD_PATH.include?(@oldlibdir)
         @oldlibdir = value
         $LOAD_PATH << value
       end
     },
     :ignoreimport => [false, "A parameter that can be used in commit
       hooks, since it enables you to parse-check a single file rather
       than requiring that all files exist."],
     :authconfig => [ "$confdir/namespaceauth.conf",
       "The configuration file that defines the rights to the different
       namespaces and methods.  This can be used as a coarse-grained
       authorization system for both `puppet agent` and `puppet master`."
     ],
     :environment => {:default => "production", :desc => "The environment Puppet is running in.  For clients
       (e.g., `puppet agent`) this determines the environment itself, which
       is used to find modules and much more.  For servers (i.e., `puppet master`) this provides the default environment for nodes
       we know nothing about."
     },
     :diff_args => ["-u", "Which arguments to pass to the diff command when printing differences between files."],
     :diff => ["diff", "Which diff command to use when printing differences between files."],
     :show_diff => [false, "Whether to print a contextual diff when files are being replaced.  The diff
       is printed on stdout, so this option is meaningless unless you are running Puppet interactively.
       This feature currently requires the `diff/lcs` Ruby library."],
     :daemonize => { :default => true,
       :desc => "Send the process into the background.  This is the default.",
       :short => "D"
     },
     :maximum_uid => [4294967290, "The maximum allowed UID.  Some platforms use negative UIDs
       but then ship with tools that do not know how to handle signed ints, so the UIDs show up as
       huge numbers that can then not be fed back into the system.  This is a hackish way to fail in a
       slightly more useful way when that happens."],
     :node_terminus => ["plain", "Where to find information about nodes."],
     :catalog_terminus => ["compiler", "Where to get node catalogs.  This is useful to change if, for instance,
       you'd like to pre-compile catalogs and store them in memcached or some other easily-accessed store."],
     :facts_terminus => {
       :default => Puppet.application_name.to_s == "master" ? 'yaml' : 'facter',
       :desc => "The node facts terminus.",
       :hook => proc do |value|
         require 'puppet/node/facts'
         if value.to_s == "rest"
           Puppet::Node::Facts.indirection.cache_class = :yaml
         end
       end
     },
     :inventory_terminus => [ "$facts_terminus", "Should usually be the same as the facts terminus" ],
     :httplog => { :default => "$logdir/http.log",
       :owner => "root",
       :mode => 0640,
       :desc => "Where the puppet agent web server logs."
     },
     :http_proxy_host => ["none",
       "The HTTP proxy host to use for outgoing connections.  Note: You
       may need to use a FQDN for the server hostname when using a proxy."],
     :http_proxy_port => [3128, "The HTTP proxy port to use for outgoing connections"],
     :filetimeout => [ 15,
       "The minimum time to wait (in seconds) between checking for updates in
       configuration files.  This timeout determines how quickly Puppet checks whether
       a file (such as manifests or templates) has changed on disk."
     ],
     :queue_type => ["stomp", "Which type of queue to use for asynchronous processing."],
     :queue_type => ["stomp", "Which type of queue to use for asynchronous processing."],
     :queue_source => ["stomp://localhost:61613/", "Which type of queue to use for asynchronous processing.  If your stomp server requires
       authentication, you can include it in the URI as long as your stomp client library is at least 1.1.1"],
     :async_storeconfigs => {:default => false, :desc => "Whether to use a queueing system to provide asynchronous database integration.
       Requires that `puppetqd` be running and that 'PSON' support for ruby be installed.",
       :hook => proc do |value|
         if value
           # This reconfigures the terminii for Node, Facts, and Catalog
           Puppet.settings[:storeconfigs] = true
 
           # But then we modify the configuration
           Puppet::Resource::Catalog.indirection.cache_class = :queue
         else
           raise "Cannot disable asynchronous storeconfigs in a running process"
         end
       end
     },
     :thin_storeconfigs => {:default => false, :desc =>
       "Boolean; wether storeconfigs store in the database only the facts and exported resources.
       If true, then storeconfigs performance will be higher and still allow exported/collected
       resources, but other usage external to Puppet might not work",
       :hook => proc do |value|
         Puppet.settings[:storeconfigs] = true if value
         end
       },
     :config_version => ["", "How to determine the configuration version.  By default, it will be the
       time that the configuration is parsed, but you can provide a shell script to override how the
       version is determined.  The output of this script will be added to every log message in the
       reports, allowing you to correlate changes on your hosts to the source version on the server."],
     :zlib => [true,
       "Boolean; whether to use the zlib library",
     ],
     :prerun_command => ["", "A command to run before every agent run.  If this command returns a non-zero
       return code, the entire Puppet run will fail."],
     :postrun_command => ["", "A command to run after every agent run.  If this command returns a non-zero
       return code, the entire Puppet run will be considered to have failed, even though it might have
       performed work during the normal run."],
     :freeze_main => [false, "Freezes the 'main' class, disallowing any code to be added to it.  This
       essentially means that you can't have any code outside of a node, class, or definition other
       than in the site manifest."]
   )
 
   hostname = Facter["hostname"].value
   domain = Facter["domain"].value
   if domain and domain != ""
     fqdn = [hostname, domain].join(".")
   else
     fqdn = hostname
   end
 
 
     Puppet.setdefaults(
     :main,
 
     # We have to downcase the fqdn, because the current ssl stuff (as oppsed to in master) doesn't have good facilities for
     # manipulating naming.
     :certname => {:default => fqdn.downcase, :desc => "The name to use when handling certificates.  Defaults
       to the fully qualified domain name.",
       :call_on_define => true, # Call our hook with the default value, so we're always downcased
       :hook => proc { |value| raise(ArgumentError, "Certificate names must be lower case; see #1168") unless value == value.downcase }},
     :certdnsnames => ['', "The DNS names on the Server certificate as a colon-separated list.
       If it's anything other than an empty string, it will be used as an alias in the created
       certificate.  By default, only the server gets an alias set up, and only for 'puppet'."],
     :certdir => {
       :default => "$ssldir/certs",
       :owner => "service",
       :desc => "The certificate directory."
     },
     :ssldir => {
       :default => "$confdir/ssl",
       :mode => 0771,
       :owner => "service",
       :desc => "Where SSL certificates are kept."
     },
     :publickeydir => {
       :default => "$ssldir/public_keys",
       :owner => "service",
       :desc => "The public key directory."
     },
     :requestdir => {
       :default => "$ssldir/certificate_requests",
       :owner => "service",
       :desc => "Where host certificate requests are stored."
     },
     :privatekeydir => { :default => "$ssldir/private_keys",
       :mode => 0750,
       :owner => "service",
       :desc => "The private key directory."
     },
     :privatedir => { :default => "$ssldir/private",
       :mode => 0750,
       :owner => "service",
       :desc => "Where the client stores private certificate information."
     },
     :passfile => { :default => "$privatedir/password",
       :mode => 0640,
       :owner => "service",
       :desc => "Where puppet agent stores the password for its private key.
         Generally unused."
     },
     :hostcsr => { :default => "$ssldir/csr_$certname.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where individual hosts store and look for their certificate requests."
     },
     :hostcert => { :default => "$certdir/$certname.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where individual hosts store and look for their certificates."
     },
     :hostprivkey => { :default => "$privatekeydir/$certname.pem",
       :mode => 0600,
       :owner => "service",
       :desc => "Where individual hosts store and look for their private key."
     },
     :hostpubkey => { :default => "$publickeydir/$certname.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where individual hosts store and look for their public key."
     },
     :localcacert => { :default => "$certdir/ca.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where each client stores the CA certificate."
     },
     :hostcrl => { :default => "$ssldir/crl.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where the host's certificate revocation list can be found.
         This is distinct from the certificate authority's CRL."
     },
     :certificate_revocation => [true, "Whether certificate revocation should be supported by downloading a Certificate Revocation List (CRL)
       to all clients.  If enabled, CA chaining will almost definitely not work."]
   )
 
     setdefaults(
     :ca,
     :ca_name => ["Puppet CA: $certname", "The name to use the Certificate Authority certificate."],
     :cadir => {  :default => "$ssldir/ca",
       :owner => "service",
       :group => "service",
       :mode => 0770,
       :desc => "The root directory for the certificate authority."
     },
     :cacert => { :default => "$cadir/ca_crt.pem",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "The CA certificate."
     },
     :cakey => { :default => "$cadir/ca_key.pem",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "The CA private key."
     },
     :capub => { :default => "$cadir/ca_pub.pem",
       :owner => "service",
       :group => "service",
       :desc => "The CA public key."
     },
     :cacrl => { :default => "$cadir/ca_crl.pem",
       :owner => "service",
       :group => "service",
       :mode => 0664,
 
       :desc => "The certificate revocation list (CRL) for the CA. Will be used if present but otherwise ignored.",
       :hook => proc do |value|
         if value == 'false'
           Puppet.warning "Setting the :cacrl to 'false' is deprecated; Puppet will just ignore the crl if yours is missing"
         end
       end
     },
     :caprivatedir => { :default => "$cadir/private",
       :owner => "service",
       :group => "service",
       :mode => 0770,
       :desc => "Where the CA stores private certificate information."
     },
     :csrdir => { :default => "$cadir/requests",
       :owner => "service",
       :group => "service",
       :desc => "Where the CA stores certificate requests"
     },
     :signeddir => { :default => "$cadir/signed",
       :owner => "service",
       :group => "service",
       :mode => 0770,
       :desc => "Where the CA stores signed certificates."
     },
     :capass => { :default => "$caprivatedir/ca.pass",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "Where the CA stores the password for the private key"
     },
     :serial => { :default => "$cadir/serial",
       :owner => "service",
       :group => "service",
       :mode => 0644,
       :desc => "Where the serial number for certificates is stored."
     },
     :autosign => { :default => "$confdir/autosign.conf",
       :mode => 0644,
       :desc => "Whether to enable autosign.  Valid values are true (which
         autosigns any key request, and is a very bad idea), false (which
         never autosigns any key request), and the path to a file, which
         uses that configuration file to determine which keys to sign."},
     :ca_days => ["", "How long a certificate should be valid.
       This parameter is deprecated, use ca_ttl instead"],
     :ca_ttl => ["5y", "The default TTL for new certificates; valid values
       must be an integer, optionally followed by one of the units
       'y' (years of 365 days), 'd' (days), 'h' (hours), or
       's' (seconds). The unit defaults to seconds. If this parameter
       is set, ca_days is ignored. Examples are '3600' (one hour)
       and '1825d', which is the same as '5y' (5 years) "],
     :ca_md => ["md5", "The type of hash used in certificates."],
     :req_bits => [2048, "The bit length of the certificates."],
     :keylength => [1024, "The bit length of keys."],
     :cert_inventory => {
       :default => "$cadir/inventory.txt",
       :mode => 0644,
       :owner => "service",
       :group => "service",
       :desc => "A Complete listing of all certificates"
     }
   )
 
   # Define the config default.
 
     setdefaults(
     Puppet.settings[:name],
     :config => ["$confdir/puppet.conf",
       "The configuration file for #{Puppet[:name]}."],
     :pidfile => ["$rundir/$name.pid", "The pid file"],
     :bindaddress => ["", "The address a listening server should bind to.  Mongrel servers
       default to 127.0.0.1 and WEBrick defaults to 0.0.0.0."],
     :servertype => {:default => "webrick", :desc => "The type of server to use.  Currently supported
       options are webrick and mongrel.  If you use mongrel, you will need
       a proxy in front of the process or processes, since Mongrel cannot
       speak SSL.",
 
       :call_on_define => true, # Call our hook with the default value, so we always get the correct bind address set.
       :hook => proc { |value|  value == "webrick" ? Puppet.settings[:bindaddress] = "0.0.0.0" : Puppet.settings[:bindaddress] = "127.0.0.1" if Puppet.settings[:bindaddress] == "" }
     }
   )
 
   setdefaults(:master,
     :user => ["puppet", "The user puppet master should run as."],
     :group => ["puppet", "The group puppet master should run as."],
     :manifestdir => ["$confdir/manifests", "Where puppet master looks for its manifests."],
     :manifest => ["$manifestdir/site.pp", "The entry-point manifest for puppet master."],
     :code => ["", "Code to parse directly.  This is essentially only used
       by `puppet`, and should only be set if you're writing your own Puppet
       executable"],
     :masterlog => { :default => "$logdir/puppetmaster.log",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "Where puppet master logs.  This is generally not used,
         since syslog is the default log destination."
     },
     :masterhttplog => { :default => "$logdir/masterhttp.log",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :create => true,
       :desc => "Where the puppet master web server logs."
     },
     :masterport => [8140, "Which port puppet master listens on."],
     :parseonly => [false, "Just check the syntax of the manifests."],
     :node_name => ["cert", "How the puppetmaster determines the client's identity
       and sets the 'hostname', 'fqdn' and 'domain' facts for use in the manifest,
       in particular for determining which 'node' statement applies to the client.
       Possible values are 'cert' (use the subject's CN in the client's
       certificate) and 'facter' (use the hostname that the client
       reported in its facts)"],
     :bucketdir => {
       :default => "$vardir/bucket",
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "Where FileBucket files are stored."
     },
     :rest_authconfig => [ "$confdir/auth.conf",
       "The configuration file that defines the rights to the different
       rest indirections.  This can be used as a fine-grained
       authorization system for `puppet master`."
     ],
     :ca => [true, "Wether the master should function as a certificate authority."],
     :modulepath => {:default => "$confdir/modules:/usr/share/puppet/modules",
       :desc => "The search path for modules as a colon-separated list of
       directories.", :type => :setting }, # We don't want this to be considered a file, since it's multiple files.
     :ssl_client_header => ["HTTP_X_CLIENT_DN", "The header containing an authenticated
       client's SSL DN.  Only used with Mongrel.  This header must be set by the proxy
       to the authenticated client's SSL DN (e.g., `/CN=puppet.puppetlabs.com`).
       See http://projects.puppetlabs.com/projects/puppet/wiki/Using_Mongrel for more information."],
     :ssl_client_verify_header => ["HTTP_X_CLIENT_VERIFY", "The header containing the status
       message of the client verification. Only used with Mongrel.  This header must be set by the proxy
       to 'SUCCESS' if the client successfully authenticated, and anything else otherwise.
       See http://projects.puppetlabs.com/projects/puppet/wiki/Using_Mongrel for more information."],
     # To make sure this directory is created before we try to use it on the server, we need
     # it to be in the server section (#1138).
     :yamldir => {:default => "$vardir/yaml", :owner => "service", :group => "service", :mode => "750",
       :desc => "The directory in which YAML data is stored, usually in a subdirectory."},
     :server_datadir => {:default => "$vardir/server_data", :owner => "service", :group => "service", :mode => "750",
       :desc => "The directory in which serialized data is stored, usually in a subdirectory."},
     :reports => ["store",
       "The list of reports to generate.  All reports are looked for
       in `puppet/reports/name.rb`, and multiple report names should be
       comma-separated (whitespace is okay)."
     ],
     :reportdir => {:default => "$vardir/reports",
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "The directory in which to store reports
         received from the client.  Each client gets a separate
         subdirectory."},
     :reporturl => ["http://localhost:3000/reports",
       "The URL used by the http reports processor to send reports"],
     :fileserverconfig => ["$confdir/fileserver.conf", "Where the fileserver configuration is stored."],
     :strict_hostname_checking => [false, "Whether to only search for the complete
       hostname as it is in the certificate when searching for node information
       in the catalogs."]
   )
 
   setdefaults(:metrics,
     :rrddir => {:default => "$vardir/rrd",
       :owner => "service",
       :group => "service",
       :desc => "The directory where RRD database files are stored.
         Directories for each reporting host will be created under
         this directory."
     },
     :rrdinterval => ["$runinterval", "How often RRD should expect data.
       This should match how often the hosts report back to the server."]
   )
 
   setdefaults(:agent,
     :localconfig => { :default => "$statedir/localconfig",
       :owner => "root",
       :mode => 0660,
       :desc => "Where puppet agent caches the local configuration.  An
         extension indicating the cache format is added automatically."},
     :statefile => { :default => "$statedir/state.yaml",
       :mode => 0660,
       :desc => "Where puppet agent and puppet master store state associated
         with the running configuration.  In the case of puppet master,
         this file reflects the state discovered through interacting
         with clients."
       },
     :clientyamldir => {:default => "$vardir/client_yaml", :mode => "750", :desc => "The directory in which client-side YAML data is stored."},
     :client_datadir => {:default => "$vardir/client_data", :mode => "750", :desc => "The directory in which serialized data is stored on the client."},
     :classfile => { :default => "$statedir/classes.txt",
       :owner => "root",
       :mode => 0644,
       :desc => "The file in which puppet agent stores a list of the classes
         associated with the retrieved configuration.  Can be loaded in
         the separate `puppet` executable using the `--loadclasses`
         option."},
     :puppetdlog => { :default => "$logdir/puppetd.log",
       :owner => "root",
       :mode => 0640,
       :desc => "The log file for puppet agent.  This is generally not used."
     },
     :server => ["puppet", "The server to which server puppet agent should connect"],
     :ignoreschedules => [false,
       "Boolean; whether puppet agent should ignore schedules.  This is useful
       for initial puppet agent runs."],
     :puppetport => [8139, "Which port puppet agent listens on."],
     :noop => [false, "Whether puppet agent should be run in noop mode."],
     :runinterval => [1800, # 30 minutes
       "How often puppet agent applies the client configuration; in seconds."],
     :listen => [false, "Whether puppet agent should listen for
       connections.  If this is true, then by default only the
       `runner` server is started, which allows remote authorized
       and authenticated nodes to connect and trigger `puppet agent`
       runs."],
     :ca_server => ["$server", "The server to use for certificate
       authority requests.  It's a separate server because it cannot
       and does not need to horizontally scale."],
     :ca_port => ["$masterport", "The port to use for the certificate authority."],
     :catalog_format => {
       :default => "",
       :desc => "(Deprecated for 'preferred_serialization_format') What format to
         use to dump the catalog.  Only supports 'marshal' and 'yaml'.  Only
         matters on the client, since it asks the server for a specific format.",
       :hook => proc { |value|
         if value
           Puppet.warning "Setting 'catalog_format' is deprecated; use 'preferred_serialization_format' instead."
           Puppet.settings[:preferred_serialization_format] = value
         end
       }
     },
     :preferred_serialization_format => ["pson", "The preferred means of serializing
       ruby instances for passing over the wire.  This won't guarantee that all
       instances will be serialized using this method, since not all classes
       can be guaranteed to support this format, but it will be used for all
       classes that support it."],
     :puppetdlockfile => [ "$statedir/puppetdlock", "A lock file to temporarily stop puppet agent from doing anything."],
     :usecacheonfailure => [true,
       "Whether to use the cached configuration when the remote
       configuration will not compile.  This option is useful for testing
       new configurations, where you want to fix the broken configuration
       rather than reverting to a known-good one."
     ],
     :use_cached_catalog => [false,
       "Whether to only use the cached catalog rather than compiling a new catalog
       on every run.  Puppet can be run with this enabled by default and then selectively
       disabled when a recompile is desired."],
     :ignorecache => [false,
       "Ignore cache and always recompile the configuration.  This is
       useful for testing new configurations, where the local cache may in
       fact be stale even if the timestamps are up to date - if the facts
       change or if the server changes."
     ],
     :downcasefacts => [false, "Whether facts should be made all lowercase when sent to the server."],
     :dynamicfacts => ["memorysize,memoryfree,swapsize,swapfree",
       "Facts that are dynamic; these facts will be ignored when deciding whether
       changed facts should result in a recompile.  Multiple facts should be
       comma-separated."],
     :splaylimit => ["$runinterval",
       "The maximum time to delay before runs.  Defaults to being the same as the
       run interval."],
     :splay => [false,
       "Whether to sleep for a pseudo-random (but consistent) amount of time before
       a run."],
     :clientbucketdir => {
       :default => "$vardir/clientbucket",
       :mode => 0750,
       :desc => "Where FileBucket files are stored locally."
     },
     :configtimeout => [120,
       "How long the client should wait for the configuration to be retrieved
       before considering it a failure.  This can help reduce flapping if too
       many clients contact the server at one time."
     ],
     :reportserver => {
       :default => "$server",
       :call_on_define => false,
       :desc => "(Deprecated for 'report_server') The server to which to send transaction reports.",
       :hook => proc do |value|
         Puppet.settings[:report_server] = value if value
       end
     },
     :report_server => ["$server",
       "The server to send transaction reports to."
     ],
     :report_port => ["$masterport",
       "The port to communicate with the report_server."
     ],
     :inventory_server => ["$server",
       "The server to send facts to."
     ],
     :inventory_port => ["$masterport",
       "The port to communicate with the inventory_server."
     ],
     :report => [true,
       "Whether to send reports after every transaction."
     ],
     :lastrunfile =>  { :default => "$statedir/last_run_summary.yaml",
       :mode => 0660,
       :desc => "Where puppet agent stores the last run report summary in yaml format."
     },
     :lastrunreport =>  { :default => "$statedir/last_run_report.yaml",
       :mode => 0660,
       :desc => "Where puppet agent stores the last run report in yaml format."
     },
     :graph => [false, "Whether to create dot graph files for the different
       configuration graphs.  These dot files can be interpreted by tools
       like OmniGraffle or dot (which is part of ImageMagick)."],
     :graphdir => ["$statedir/graphs", "Where to store dot-outputted graphs."],
     :http_compression => [false, "Allow http compression in REST communication with the master.
       This setting might improve performance for agent -> master communications over slow WANs.
       Your puppetmaster needs to support compression (usually by activating some settings in a reverse-proxy
       in front of the puppetmaster, which rules out webrick).
       It is harmless to activate this settings if your master doesn't support
       compression, but if it supports it, this setting might reduce performance on high-speed LANs."]
   )
 
   setdefaults(:inspect,
       :archive_files => [false, "During an inspect run, whether to archive files whose contents are audited to a file bucket."],
       :archive_file_server => ["$server", "During an inspect run, the file bucket server to archive files to if archive_files is set."]
   )
 
   # Plugin information.
 
     setdefaults(
     :main,
     :plugindest => ["$libdir",
       "Where Puppet should store plugins that it pulls down from the central
       server."],
     :pluginsource => ["puppet://$server/plugins",
       "From where to retrieve plugins.  The standard Puppet `file` type
       is used for retrieval, so anything that is a valid file source can
       be used here."],
     :pluginsync => [false, "Whether plugins should be synced with the central server."],
 
     :pluginsignore => [".svn CVS .git", "What files to ignore when pulling down plugins."]
   )
 
   # Central fact information.
 
     setdefaults(
     :main,
     :factpath => {:default => "$vardir/lib/facter:$vardir/facts",
       :desc => "Where Puppet should look for facts.  Multiple directories should
         be colon-separated, like normal PATH variables.",
 
       :call_on_define => true, # Call our hook with the default value, so we always get the value added to facter.
       :type => :setting, # Don't consider it a file, because it could be multiple colon-separated files
       :hook => proc { |value| Facter.search(value) if Facter.respond_to?(:search) }},
     :factdest => ["$vardir/facts/",
       "Where Puppet should store facts that it pulls down from the central
       server."],
     :factsource => ["puppet://$server/facts/",
       "From where to retrieve facts.  The standard Puppet `file` type
       is used for retrieval, so anything that is a valid file source can
       be used here."],
     :factsync => [false, "Whether facts should be synced with the central server."],
     :factsignore => [".svn CVS", "What files to ignore when pulling down facts."]
   )
 
 
     setdefaults(
     :tagmail,
     :tagmap => ["$confdir/tagmail.conf", "The mapping between reporting tags and email addresses."],
     :sendmail => [which('sendmail') || '', "Where to find the sendmail binary with which to send email."],
 
     :reportfrom => ["report@" + [Facter["hostname"].value, Facter["domain"].value].join("."), "The 'from' email address for the reports."],
     :smtpserver => ["none", "The server through which to send email reports."]
   )
 
     setdefaults(
     :rails,
     :dblocation => { :default => "$statedir/clientconfigs.sqlite3",
       :mode => 0660,
       :owner => "service",
       :group => "service",
       :desc => "The database cache for client configurations.  Used for
         querying within the language."
     },
     :dbadapter => [ "sqlite3", "The type of database to use." ],
     :dbmigrate => [ false, "Whether to automatically migrate the database." ],
     :dbname => [ "puppet", "The name of the database to use." ],
     :dbserver => [ "localhost", "The database server for caching. Only
       used when networked databases are used."],
     :dbport => [ "", "The database password for caching. Only
       used when networked databases are used."],
     :dbuser => [ "puppet", "The database user for caching. Only
       used when networked databases are used."],
     :dbpassword => [ "puppet", "The database password for caching. Only
       used when networked databases are used."],
     :dbconnections => [ '', "The number of database connections for networked
       databases.  Will be ignored unless the value is a positive integer."],
     :dbsocket => [ "", "The database socket location. Only used when networked
       databases are used.  Will be ignored if the value is an empty string."],
     :railslog => {:default => "$logdir/rails.log",
       :mode => 0600,
       :owner => "service",
       :group => "service",
       :desc => "Where Rails-specific logs are sent"
     },
 
     :rails_loglevel => ["info", "The log level for Rails connections.  The value must be
       a valid log level within Rails.  Production environments normally use `info`
       and other environments normally use `debug`."]
   )
 
     setdefaults(
     :couchdb,
 
     :couchdb_url => ["http://127.0.0.1:5984/puppet", "The url where the puppet couchdb database will be created"]
   )
 
     setdefaults(
     :transaction,
     :tags => ["", "Tags to use to find resources.  If this is set, then
       only resources tagged with the specified tags will be applied.
       Values must be comma-separated."],
     :evaltrace => [false, "Whether each resource should log when it is
       being evaluated.  This allows you to interactively see exactly
       what is being done."],
     :summarize => [false,
 
       "Whether to print a transaction summary."
     ]
   )
 
     setdefaults(
     :main,
     :external_nodes => ["none",
 
       "An external command that can produce node information.  The output
       must be a YAML dump of a hash, and that hash must have one or both of
       `classes` and `parameters`, where `classes` is an array and
       `parameters` is a hash.  For unknown nodes, the commands should
       exit with a non-zero exit code.
 
       This command makes it straightforward to store your node mapping
       information in other data sources like databases."])
 
         setdefaults(
         :ldap,
     :ldapnodes => [false,
       "Whether to search for node configurations in LDAP.  See
       http://projects.puppetlabs.com/projects/puppet/wiki/LDAP_Nodes for more information."],
     :ldapssl => [false,
       "Whether SSL should be used when searching for nodes.
       Defaults to false because SSL usually requires certificates
       to be set up on the client side."],
     :ldaptls => [false,
       "Whether TLS should be used when searching for nodes.
       Defaults to false because TLS usually requires certificates
       to be set up on the client side."],
     :ldapserver => ["ldap",
       "The LDAP server.  Only used if `ldapnodes` is enabled."],
     :ldapport => [389,
       "The LDAP port.  Only used if `ldapnodes` is enabled."],
 
     :ldapstring => ["(&(objectclass=puppetClient)(cn=%s))",
       "The search string used to find an LDAP node."],
     :ldapclassattrs => ["puppetclass",
       "The LDAP attributes to use to define Puppet classes.  Values
       should be comma-separated."],
     :ldapstackedattrs => ["puppetvar",
       "The LDAP attributes that should be stacked to arrays by adding
       the values in all hierarchy elements of the tree.  Values
       should be comma-separated."],
     :ldapattrs => ["all",
       "The LDAP attributes to include when querying LDAP for nodes.  All
       returned attributes are set as variables in the top-level scope.
       Multiple values should be comma-separated.  The value 'all' returns
       all attributes."],
     :ldapparentattr => ["parentnode",
       "The attribute to use to define the parent node."],
     :ldapuser => ["",
       "The user to use to connect to LDAP.  Must be specified as a
       full DN."],
     :ldappassword => ["", "The password to use to connect to LDAP."],
     :ldapbase => ["",
       "The search base for LDAP searches.  It's impossible to provide
       a meaningful default here, although the LDAP libraries might
       have one already set.  Generally, it should be the 'ou=Hosts'
       branch under your main directory."]
   )
 
   setdefaults(:master,
     :storeconfigs => {:default => false, :desc => "Whether to store each client's configuration.  This
       requires ActiveRecord from Ruby on Rails.",
       :call_on_define => true, # Call our hook with the default value, so we always get the libdir set.
       :hook => proc do |value|
         require 'puppet/node'
         require 'puppet/node/facts'
         if value
           require 'puppet/rails'
           raise "StoreConfigs not supported without ActiveRecord 2.1 or higher" unless Puppet.features.rails?
           Puppet::Resource::Catalog.indirection.cache_class = :active_record unless Puppet.settings[:async_storeconfigs]
           Puppet::Node::Facts.indirection.cache_class = :active_record
           Puppet::Node.indirection.cache_class = :active_record
         end
       end
     }
   )
 
   # This doesn't actually work right now.
 
     setdefaults(
     :parser,
 
     :lexical => [false, "Whether to use lexical scoping (vs. dynamic)."],
     :templatedir => ["$vardir/templates",
       "Where Puppet looks for template files.  Can be a list of colon-seperated
       directories."
     ]
   )
 end
diff --git a/lib/puppet/type.rb b/lib/puppet/type.rb
index e03650b54..f70a3ec0b 100644
--- a/lib/puppet/type.rb
+++ b/lib/puppet/type.rb
@@ -1,1897 +1,1910 @@
 require 'puppet'
 require 'puppet/util/log'
 require 'puppet/util/metric'
 require 'puppet/property'
 require 'puppet/parameter'
 require 'puppet/util'
 require 'puppet/util/autoload'
 require 'puppet/metatype/manager'
 require 'puppet/util/errors'
 require 'puppet/util/log_paths'
 require 'puppet/util/logging'
 require 'puppet/util/cacher'
 require 'puppet/file_collection/lookup'
 require 'puppet/util/tagging'
 
 # see the bottom of the file for the rest of the inclusions
 
 module Puppet
 class Type
   include Puppet::Util
   include Puppet::Util::Errors
   include Puppet::Util::LogPaths
   include Puppet::Util::Logging
   include Puppet::Util::Cacher
   include Puppet::FileCollection::Lookup
   include Puppet::Util::Tagging
 
   ###############################
   # Code related to resource type attributes.
   class << self
     include Puppet::Util::ClassGen
     include Puppet::Util::Warnings
     attr_reader :properties
   end
 
   def self.states
     warnonce "The states method is deprecated; use properties"
     properties
   end
 
   # All parameters, in the appropriate order.  The key_attributes come first, then
   # the provider, then the properties, and finally the params and metaparams
   # in the order they were specified in the files.
   def self.allattrs
     key_attributes | (parameters & [:provider]) | properties.collect { |property| property.name } | parameters | metaparams
   end
 
   # Retrieve an attribute alias, if there is one.
   def self.attr_alias(param)
     @attr_aliases[symbolize(param)]
   end
 
   # Create an alias to an existing attribute.  This will cause the aliased
   # attribute to be valid when setting and retrieving values on the instance.
   def self.set_attr_alias(hash)
     hash.each do |new, old|
       @attr_aliases[symbolize(new)] = symbolize(old)
     end
   end
 
   # Find the class associated with any given attribute.
   def self.attrclass(name)
     @attrclasses ||= {}
 
     # We cache the value, since this method gets called such a huge number
     # of times (as in, hundreds of thousands in a given run).
     unless @attrclasses.include?(name)
       @attrclasses[name] = case self.attrtype(name)
       when :property; @validproperties[name]
       when :meta; @@metaparamhash[name]
       when :param; @paramhash[name]
       end
     end
     @attrclasses[name]
   end
 
   # What type of parameter are we dealing with? Cache the results, because
   # this method gets called so many times.
   def self.attrtype(attr)
     @attrtypes ||= {}
     unless @attrtypes.include?(attr)
       @attrtypes[attr] = case
         when @validproperties.include?(attr); :property
         when @paramhash.include?(attr); :param
         when @@metaparamhash.include?(attr); :meta
         end
     end
 
     @attrtypes[attr]
   end
 
   def self.eachmetaparam
     @@metaparams.each { |p| yield p.name }
   end
 
   # Create the 'ensure' class.  This is a separate method so other types
   # can easily call it and create their own 'ensure' values.
   def self.ensurable(&block)
     if block_given?
       self.newproperty(:ensure, :parent => Puppet::Property::Ensure, &block)
     else
       self.newproperty(:ensure, :parent => Puppet::Property::Ensure) do
         self.defaultvalues
       end
     end
   end
 
   # Should we add the 'ensure' property to this class?
   def self.ensurable?
     # If the class has all three of these methods defined, then it's
     # ensurable.
     ens = [:exists?, :create, :destroy].inject { |set, method|
       set &&= self.public_method_defined?(method)
     }
 
     ens
   end
 
   # Deal with any options passed into parameters.
   def self.handle_param_options(name, options)
     # If it's a boolean parameter, create a method to test the value easily
     if options[:boolean]
       define_method(name.to_s + "?") do
         val = self[name]
         if val == :true or val == true
           return true
         end
       end
     end
   end
 
   # Is the parameter in question a meta-parameter?
   def self.metaparam?(param)
     @@metaparamhash.include?(symbolize(param))
   end
 
   # Find the metaparameter class associated with a given metaparameter name.
   def self.metaparamclass(name)
     @@metaparamhash[symbolize(name)]
   end
 
   def self.metaparams
     @@metaparams.collect { |param| param.name }
   end
 
   def self.metaparamdoc(metaparam)
     @@metaparamhash[metaparam].doc
   end
 
   # Create a new metaparam.  Requires a block and a name, stores it in the
   # @parameters array, and does some basic checking on it.
   def self.newmetaparam(name, options = {}, &block)
     @@metaparams ||= []
     @@metaparamhash ||= {}
     name = symbolize(name)
 
 
       param = genclass(
         name,
       :parent => options[:parent] || Puppet::Parameter,
       :prefix => "MetaParam",
       :hash => @@metaparamhash,
       :array => @@metaparams,
       :attributes => options[:attributes],
 
       &block
     )
 
     # Grr.
     param.required_features = options[:required_features] if options[:required_features]
 
     handle_param_options(name, options)
 
     param.metaparam = true
 
     param
   end
 
   def self.key_attribute_parameters
     @key_attribute_parameters ||= (
       params = @parameters.find_all { |param|
         param.isnamevar? or param.name == :name
       }
     )
   end
 
   def self.key_attributes
     key_attribute_parameters.collect { |p| p.name }
   end
 
   def self.title_patterns
     case key_attributes.length
     when 0; []
     when 1;
       identity = lambda {|x| x}
       [ [ /(.*)/m, [ [key_attributes.first, identity ] ] ] ]
     else
       raise Puppet::DevError,"you must specify title patterns when there are two or more key attributes"
     end
   end
 
   def uniqueness_key
     to_resource.uniqueness_key
   end
 
   # Create a new parameter.  Requires a block and a name, stores it in the
   # @parameters array, and does some basic checking on it.
   def self.newparam(name, options = {}, &block)
     options[:attributes] ||= {}
 
       param = genclass(
         name,
       :parent => options[:parent] || Puppet::Parameter,
       :attributes => options[:attributes],
       :block => block,
       :prefix => "Parameter",
       :array => @parameters,
 
       :hash => @paramhash
     )
 
     handle_param_options(name, options)
 
     # Grr.
     param.required_features = options[:required_features] if options[:required_features]
 
     param.isnamevar if options[:namevar]
 
     param
   end
 
   def self.newstate(name, options = {}, &block)
     Puppet.warning "newstate() has been deprecrated; use newproperty(#{name})"
     newproperty(name, options, &block)
   end
 
   # Create a new property. The first parameter must be the name of the property;
   # this is how users will refer to the property when creating new instances.
   # The second parameter is a hash of options; the options are:
   # * <tt>:parent</tt>: The parent class for the property.  Defaults to Puppet::Property.
   # * <tt>:retrieve</tt>: The method to call on the provider or @parent object (if
   #   the provider is not set) to retrieve the current value.
   def self.newproperty(name, options = {}, &block)
     name = symbolize(name)
 
     # This is here for types that might still have the old method of defining
     # a parent class.
     unless options.is_a? Hash
       raise Puppet::DevError,
         "Options must be a hash, not #{options.inspect}"
     end
 
     raise Puppet::DevError, "Class #{self.name} already has a property named #{name}" if @validproperties.include?(name)
 
     if parent = options[:parent]
       options.delete(:parent)
     else
       parent = Puppet::Property
     end
 
     # We have to create our own, new block here because we want to define
     # an initial :retrieve method, if told to, and then eval the passed
     # block if available.
     prop = genclass(name, :parent => parent, :hash => @validproperties, :attributes => options) do
       # If they've passed a retrieve method, then override the retrieve
       # method on the class.
       if options[:retrieve]
         define_method(:retrieve) do
           provider.send(options[:retrieve])
         end
       end
 
       class_eval(&block) if block
     end
 
     # If it's the 'ensure' property, always put it first.
     if name == :ensure
       @properties.unshift prop
     else
       @properties << prop
     end
 
     prop
   end
 
   def self.paramdoc(param)
     @paramhash[param].doc
   end
 
   # Return the parameter names
   def self.parameters
     return [] unless defined?(@parameters)
     @parameters.collect { |klass| klass.name }
   end
 
   # Find the parameter class associated with a given parameter name.
   def self.paramclass(name)
     @paramhash[name]
   end
 
   # Return the property class associated with a name
   def self.propertybyname(name)
     @validproperties[name]
   end
 
   def self.validattr?(name)
     name = symbolize(name)
     return true if name == :name
     @validattrs ||= {}
 
     unless @validattrs.include?(name)
       @validattrs[name] = !!(self.validproperty?(name) or self.validparameter?(name) or self.metaparam?(name))
     end
 
     @validattrs[name]
   end
 
   # does the name reflect a valid property?
   def self.validproperty?(name)
     name = symbolize(name)
     @validproperties.include?(name) && @validproperties[name]
   end
 
   # Return the list of validproperties
   def self.validproperties
     return {} unless defined?(@parameters)
 
     @validproperties.keys
   end
 
   # does the name reflect a valid parameter?
   def self.validparameter?(name)
     raise Puppet::DevError, "Class #{self} has not defined parameters" unless defined?(@parameters)
     !!(@paramhash.include?(name) or @@metaparamhash.include?(name))
   end
 
   # This is a forward-compatibility method - it's the validity interface we'll use in Puppet::Resource.
   def self.valid_parameter?(name)
     validattr?(name)
   end
 
   # Return either the attribute alias or the attribute.
   def attr_alias(name)
     name = symbolize(name)
     if synonym = self.class.attr_alias(name)
       return synonym
     else
       return name
     end
   end
 
   # Are we deleting this resource?
   def deleting?
     obj = @parameters[:ensure] and obj.should == :absent
   end
 
   # Create a new property if it is valid but doesn't exist
   # Returns: true if a new parameter was added, false otherwise
   def add_property_parameter(prop_name)
     if self.class.validproperty?(prop_name) && !@parameters[prop_name]
       self.newattr(prop_name)
       return true
     end
     false
   end
 
   #
   # The name_var is the key_attribute in the case that there is only one.
   #
   def name_var
     key_attributes = self.class.key_attributes
     (key_attributes.length == 1) && key_attributes.first
   end
 
   # abstract accessing parameters and properties, and normalize
   # access to always be symbols, not strings
   # This returns a value, not an object.  It returns the 'is'
   # value, but you can also specifically return 'is' and 'should'
   # values using 'object.is(:property)' or 'object.should(:property)'.
   def [](name)
     name = attr_alias(name)
 
     fail("Invalid parameter #{name}(#{name.inspect})") unless self.class.validattr?(name)
 
     if name == :name
       name = name_var
     end
 
     if obj = @parameters[name]
       # Note that if this is a property, then the value is the "should" value,
       # not the current value.
       obj.value
     else
       return nil
     end
   end
 
   # Abstract setting parameters and properties, and normalize
   # access to always be symbols, not strings.  This sets the 'should'
   # value on properties, and otherwise just sets the appropriate parameter.
   def []=(name,value)
     name = attr_alias(name)
 
     fail("Invalid parameter #{name}") unless self.class.validattr?(name)
 
     if name == :name
       name = name_var
     end
     raise Puppet::Error.new("Got nil value for #{name}") if value.nil?
 
     property = self.newattr(name)
 
     if property
       begin
         # make sure the parameter doesn't have any errors
         property.value = value
       rescue => detail
         error = Puppet::Error.new("Parameter #{name} failed: #{detail}")
         error.set_backtrace(detail.backtrace)
         raise error
       end
     end
 
     nil
   end
 
   # remove a property from the object; useful in testing or in cleanup
   # when an error has been encountered
   def delete(attr)
     attr = symbolize(attr)
     if @parameters.has_key?(attr)
       @parameters.delete(attr)
     else
       raise Puppet::DevError.new("Undefined attribute '#{attr}' in #{self}")
     end
   end
 
   # iterate across the existing properties
   def eachproperty
     # properties is a private method
     properties.each { |property|
       yield property
     }
   end
 
   # Create a transaction event.  Called by Transaction or by
   # a property.
   def event(options = {})
     Puppet::Transaction::Event.new({:resource => self, :file => file, :line => line, :tags => tags}.merge(options))
   end
 
   # Let the catalog determine whether a given cached value is
   # still valid or has expired.
   def expirer
     catalog
   end
 
   # retrieve the 'should' value for a specified property
   def should(name)
     name = attr_alias(name)
     (prop = @parameters[name] and prop.is_a?(Puppet::Property)) ? prop.should : nil
   end
 
   # Create the actual attribute instance.  Requires either the attribute
   # name or class as the first argument, then an optional hash of
   # attributes to set during initialization.
   def newattr(name)
     if name.is_a?(Class)
       klass = name
       name = klass.name
     end
 
     unless klass = self.class.attrclass(name)
       raise Puppet::Error, "Resource type #{self.class.name} does not support parameter #{name}"
     end
 
     if provider and ! provider.class.supports_parameter?(klass)
       missing = klass.required_features.find_all { |f| ! provider.class.feature?(f) }
       info "Provider %s does not support features %s; not managing attribute %s" % [provider.class.name, missing.join(", "), name]
       return nil
     end
 
     return @parameters[name] if @parameters.include?(name)
 
     @parameters[name] = klass.new(:resource => self)
   end
 
   # return the value of a parameter
   def parameter(name)
     @parameters[name.to_sym]
   end
 
   def parameters
     @parameters.dup
   end
 
   # Is the named property defined?
   def propertydefined?(name)
     name = name.intern unless name.is_a? Symbol
     @parameters.include?(name)
   end
 
   # Return an actual property instance by name; to return the value, use 'resource[param]'
   # LAK:NOTE(20081028) Since the 'parameter' method is now a superset of this method,
   # this one should probably go away at some point.
   def property(name)
     (obj = @parameters[symbolize(name)] and obj.is_a?(Puppet::Property)) ? obj : nil
   end
 
   # For any parameters or properties that have defaults and have not yet been
   # set, set them now.  This method can be handed a list of attributes,
   # and if so it will only set defaults for those attributes.
   def set_default(attr)
     return unless klass = self.class.attrclass(attr)
     return unless klass.method_defined?(:default)
     return if @parameters.include?(klass.name)
 
     return unless parameter = newattr(klass.name)
 
     if value = parameter.default and ! value.nil?
       parameter.value = value
     else
       @parameters.delete(parameter.name)
     end
   end
 
   # Convert our object to a hash.  This just includes properties.
   def to_hash
     rethash = {}
 
     @parameters.each do |name, obj|
       rethash[name] = obj.value
     end
 
     rethash
   end
 
   def type
     self.class.name
   end
 
   # Return a specific value for an attribute.
   def value(name)
     name = attr_alias(name)
 
     (obj = @parameters[name] and obj.respond_to?(:value)) ? obj.value : nil
   end
 
   def version
     return 0 unless catalog
     catalog.version
   end
 
   # Return all of the property objects, in the order specified in the
   # class.
   def properties
     self.class.properties.collect { |prop| @parameters[prop.name] }.compact
   end
 
   # Is this type's name isomorphic with the object?  That is, if the
   # name conflicts, does it necessarily mean that the objects conflict?
   # Defaults to true.
   def self.isomorphic?
     if defined?(@isomorphic)
       return @isomorphic
     else
       return true
     end
   end
 
   def isomorphic?
     self.class.isomorphic?
   end
 
   # is the instance a managed instance?  A 'yes' here means that
   # the instance was created from the language, vs. being created
   # in order resolve other questions, such as finding a package
   # in a list
   def managed?
     # Once an object is managed, it always stays managed; but an object
     # that is listed as unmanaged might become managed later in the process,
     # so we have to check that every time
     if @managed
       return @managed
     else
       @managed = false
       properties.each { |property|
         s = property.should
         if s and ! property.class.unmanaged
           @managed = true
           break
         end
       }
       return @managed
     end
   end
 
   ###############################
   # Code related to the container behaviour.
 
   # this is a retarded hack method to get around the difference between
   # component children and file children
   def self.depthfirst?
     @depthfirst
   end
 
   def depthfirst?
     self.class.depthfirst?
   end
 
   # Remove an object.  The argument determines whether the object's
   # subscriptions get eliminated, too.
   def remove(rmdeps = true)
     # This is hackish (mmm, cut and paste), but it works for now, and it's
     # better than warnings.
     @parameters.each do |name, obj|
       obj.remove
     end
     @parameters.clear
 
     @parent = nil
 
     # Remove the reference to the provider.
     if self.provider
       @provider.clear
       @provider = nil
     end
   end
 
   ###############################
   # Code related to evaluating the resources.
 
   # Flush the provider, if it supports it.  This is called by the
   # transaction.
   def flush
     self.provider.flush if self.provider and self.provider.respond_to?(:flush)
   end
 
   # if all contained objects are in sync, then we're in sync
   # FIXME I don't think this is used on the type instances any more,
   # it's really only used for testing
   def insync?(is)
     insync = true
 
     if property = @parameters[:ensure]
       unless is.include? property
         raise Puppet::DevError,
           "The is value is not in the is array for '#{property.name}'"
       end
       ensureis = is[property]
       if property.safe_insync?(ensureis) and property.should == :absent
         return true
       end
     end
 
     properties.each { |property|
       unless is.include? property
         raise Puppet::DevError,
           "The is value is not in the is array for '#{property.name}'"
       end
 
       propis = is[property]
       unless property.safe_insync?(propis)
         property.debug("Not in sync: #{propis.inspect} vs #{property.should.inspect}")
         insync = false
       #else
       #    property.debug("In sync")
       end
     }
 
     #self.debug("#{self} sync status is #{insync}")
     insync
   end
 
   # retrieve the current value of all contained properties
   def retrieve
     fail "Provider #{provider.class.name} is not functional on this host" if self.provider.is_a?(Puppet::Provider) and ! provider.class.suitable?
 
     result = Puppet::Resource.new(type, title)
 
     # Provide the name, so we know we'll always refer to a real thing
     result[:name] = self[:name] unless self[:name] == title
 
     if ensure_prop = property(:ensure) or (self.class.validattr?(:ensure) and ensure_prop = newattr(:ensure))
       result[:ensure] = ensure_state = ensure_prop.retrieve
     else
       ensure_state = nil
     end
 
     properties.each do |property|
       next if property.name == :ensure
       if ensure_state == :absent
         result[property] = :absent
       else
         result[property] = property.retrieve
       end
     end
 
     result
   end
 
   def retrieve_resource
     resource = retrieve
     resource = Resource.new(type, title, :parameters => resource) if resource.is_a? Hash
     resource
   end
 
   # Get a hash of the current properties.  Returns a hash with
   # the actual property instance as the key and the current value
   # as the, um, value.
   def currentpropvalues
     # It's important to use the 'properties' method here, as it follows the order
     # in which they're defined in the class.  It also guarantees that 'ensure'
     # is the first property, which is important for skipping 'retrieve' on
     # all the properties if the resource is absent.
     ensure_state = false
     return properties.inject({}) do | prophash, property|
       if property.name == :ensure
         ensure_state = property.retrieve
         prophash[property] = ensure_state
       else
         if ensure_state == :absent
           prophash[property] = :absent
         else
           prophash[property] = property.retrieve
         end
       end
       prophash
     end
   end
 
   # Are we running in noop mode?
   def noop?
     # If we're not a host_config, we're almost certainly part of
     # Settings, and we want to ignore 'noop'
     return false if catalog and ! catalog.host_config?
 
     if defined?(@noop)
       @noop
     else
       Puppet[:noop]
     end
   end
 
   def noop
     noop?
   end
 
   ###############################
   # Code related to managing resource instances.
   require 'puppet/transportable'
 
   # retrieve a named instance of the current type
   def self.[](name)
     raise "Global resource access is deprecated"
     @objects[name] || @aliases[name]
   end
 
   # add an instance by name to the class list of instances
   def self.[]=(name,object)
     raise "Global resource storage is deprecated"
     newobj = nil
     if object.is_a?(Puppet::Type)
       newobj = object
     else
       raise Puppet::DevError, "must pass a Puppet::Type object"
     end
 
     if exobj = @objects[name] and self.isomorphic?
       msg = "Object '#{newobj.class.name}[#{name}]' already exists"
 
       msg += ("in file #{object.file} at line #{object.line}") if exobj.file and exobj.line
       msg += ("and cannot be redefined in file #{object.file} at line #{object.line}") if object.file and object.line
       error = Puppet::Error.new(msg)
       raise error
     else
       #Puppet.info("adding %s of type %s to class list" %
       #    [name,object.class])
       @objects[name] = newobj
     end
   end
 
   # Create an alias.  We keep these in a separate hash so that we don't encounter
   # the objects multiple times when iterating over them.
   def self.alias(name, obj)
     raise "Global resource aliasing is deprecated"
     if @objects.include?(name)
       unless @objects[name] == obj
         raise Puppet::Error.new(
           "Cannot create alias #{name}: object already exists"
         )
       end
     end
 
     if @aliases.include?(name)
       unless @aliases[name] == obj
         raise Puppet::Error.new(
           "Object #{@aliases[name].name} already has alias #{name}"
         )
       end
     end
 
     @aliases[name] = obj
   end
 
   # remove all of the instances of a single type
   def self.clear
     raise "Global resource removal is deprecated"
     if defined?(@objects)
       @objects.each do |name, obj|
         obj.remove(true)
       end
       @objects.clear
     end
     @aliases.clear if defined?(@aliases)
   end
 
   # Force users to call this, so that we can merge objects if
   # necessary.
   def self.create(args)
     # LAK:DEP Deprecation notice added 12/17/2008
     Puppet.warning "Puppet::Type.create is deprecated; use Puppet::Type.new"
     new(args)
   end
 
   # remove a specified object
   def self.delete(resource)
     raise "Global resource removal is deprecated"
     return unless defined?(@objects)
     @objects.delete(resource.title) if @objects.include?(resource.title)
     @aliases.delete(resource.title) if @aliases.include?(resource.title)
     if @aliases.has_value?(resource)
       names = []
       @aliases.each do |name, otherres|
         if otherres == resource
           names << name
         end
       end
       names.each { |name| @aliases.delete(name) }
     end
   end
 
   # iterate across each of the type's instances
   def self.each
     raise "Global resource iteration is deprecated"
     return unless defined?(@objects)
     @objects.each { |name,instance|
       yield instance
     }
   end
 
   # does the type have an object with the given name?
   def self.has_key?(name)
     raise "Global resource access is deprecated"
     @objects.has_key?(name)
   end
 
   # Retrieve all known instances.  Either requires providers or must be overridden.
   def self.instances
     raise Puppet::DevError, "#{self.name} has no providers and has not overridden 'instances'" if provider_hash.empty?
 
     # Put the default provider first, then the rest of the suitable providers.
     provider_instances = {}
     providers_by_source.collect do |provider|
       provider.instances.collect do |instance|
         # We always want to use the "first" provider instance we find, unless the resource
         # is already managed and has a different provider set
         if other = provider_instances[instance.name]
           Puppet.warning "%s %s found in both %s and %s; skipping the %s version" %
             [self.name.to_s.capitalize, instance.name, other.class.name, instance.class.name, instance.class.name]
           next
         end
         provider_instances[instance.name] = instance
 
         new(:name => instance.name, :provider => instance, :audit => :all)
       end
     end.flatten.compact
   end
 
   # Return a list of one suitable provider per source, with the default provider first.
   def self.providers_by_source
     # Put the default provider first, then the rest of the suitable providers.
     sources = []
     [defaultprovider, suitableprovider].flatten.uniq.collect do |provider|
       next if sources.include?(provider.source)
 
       sources << provider.source
       provider
     end.compact
   end
 
   # Convert a simple hash into a Resource instance.
   def self.hash2resource(hash)
     hash = hash.inject({}) { |result, ary| result[ary[0].to_sym] = ary[1]; result }
 
     title = hash.delete(:title)
     title ||= hash[:name]
     title ||= hash[key_attributes.first] if key_attributes.length == 1
 
     raise Puppet::Error, "Title or name must be provided" unless title
 
     # Now create our resource.
     resource = Puppet::Resource.new(self.name, title)
     [:catalog].each do |attribute|
       if value = hash[attribute]
         hash.delete(attribute)
         resource.send(attribute.to_s + "=", value)
       end
     end
 
     hash.each do |param, value|
       resource[param] = value
     end
     resource
   end
 
   # Create the path for logging and such.
   def pathbuilder
     if p = parent
       [p.pathbuilder, self.ref].flatten
     else
       [self.ref]
     end
   end
 
   ###############################
   # Add all of the meta parameters.
   newmetaparam(:noop) do
     desc "Boolean flag indicating whether work should actually
       be done."
 
     newvalues(:true, :false)
     munge do |value|
       case value
       when true, :true, "true"; @resource.noop = true
       when false, :false, "false"; @resource.noop = false
       end
     end
   end
 
   newmetaparam(:schedule) do
     desc "On what schedule the object should be managed.  You must create a
       schedule object, and then reference the name of that object to use
       that for your schedule:
 
           schedule { daily:
             period => daily,
             range => \"2-4\"
           }
 
           exec { \"/usr/bin/apt-get update\":
             schedule => daily
           }
 
       The creation of the schedule object does not need to appear in the
       configuration before objects that use it."
   end
 
   newmetaparam(:audit) do
-    desc "Audit specified attributes of resources over time, and report if any have changed.
-      This attribute can be used to track changes to any resource over time, and can
-      provide an audit trail of every change that happens on any given machine.
-
-      Note that you cannot both audit and manage an attribute - managing it guarantees
-      the value, and any changes already get logged."
+    desc "Marks a subset of this resource's unmanaged attributes for auditing. Accepts an
+      attribute name or a list of attribute names.
+
+      Auditing a resource attribute has two effects: First, whenever a catalog
+      is applied with puppet apply or puppet agent, Puppet will check whether
+      that attribute of the resource has been modified, comparing its current
+      value to the previous run; any change will be logged alongside any actions
+      performed by Puppet while applying the catalog.
+
+      Secondly, marking a resource attribute for auditing will include that
+      attribute in inspection reports generated by puppet inspect; see the
+      puppet inspect documentation for more details.
+
+      Managed attributes for a resource can also be audited, but note that
+      changes made by Puppet will be logged as additional modifications. (I.e.
+      if a user manually edits a file whose contents are audited and managed,
+      puppet agent's next two runs will both log an audit notice: the first run
+      will log the user's edit and then revert the file to the desired state,
+      and the second run will log the edit made by Puppet.)"
 
     validate do |list|
       list = Array(list).collect {|p| p.to_sym}
       unless list == [:all]
         list.each do |param|
           next if @resource.class.validattr?(param)
           fail "Cannot audit #{param}: not a valid attribute for #{resource}"
         end
       end
     end
 
     munge do |args|
       properties_to_audit(args).each do |param|
         next unless resource.class.validproperty?(param)
         resource.newattr(param)
       end
     end
 
     def all_properties
       resource.class.properties.find_all do |property|
         resource.provider.nil? or resource.provider.class.supports_parameter?(property)
       end.collect do |property|
         property.name
       end
     end
 
     def properties_to_audit(list)
       if !list.kind_of?(Array) && list.to_sym == :all
         list = all_properties
       else
         list = Array(list).collect { |p| p.to_sym }
       end
     end
   end
 
   newmetaparam(:check) do
     desc "Audit specified attributes of resources over time, and report if any have changed.
       This parameter has been deprecated in favor of 'audit'."
 
     munge do |args|
       resource.warning "'check' attribute is deprecated; use 'audit' instead"
       resource[:audit] = args
     end
   end
 
   newmetaparam(:loglevel) do
     desc "Sets the level that information will be logged.
       The log levels have the biggest impact when logs are sent to
       syslog (which is currently the default)."
     defaultto :notice
 
     newvalues(*Puppet::Util::Log.levels)
     newvalues(:verbose)
 
     munge do |loglevel|
       val = super(loglevel)
       if val == :verbose
         val = :info
       end
       val
     end
   end
 
   newmetaparam(:alias) do
     desc "Creates an alias for the object.  Puppet uses this internally when you
       provide a symbolic name:
 
           file { sshdconfig:
             path => $operatingsystem ? {
               solaris => \"/usr/local/etc/ssh/sshd_config\",
               default => \"/etc/ssh/sshd_config\"
             },
             source => \"...\"
           }
 
           service { sshd:
             subscribe => File[sshdconfig]
           }
 
       When you use this feature, the parser sets `sshdconfig` as the name,
       and the library sets that as an alias for the file so the dependency
       lookup for `sshd` works.  You can use this parameter yourself,
       but note that only the library can use these aliases; for instance,
       the following code will not work:
 
           file { \"/etc/ssh/sshd_config\":
             owner => root,
             group => root,
             alias => sshdconfig
           }
 
           file { sshdconfig:
             mode => 644
           }
 
       There's no way here for the Puppet parser to know that these two stanzas
       should be affecting the same file.
 
       See the [Language Tutorial](http://docs.puppetlabs.com/guides/language_tutorial.html) for more information.
 
       "
 
     munge do |aliases|
       aliases = [aliases] unless aliases.is_a?(Array)
 
       raise(ArgumentError, "Cannot add aliases without a catalog") unless @resource.catalog
 
       aliases.each do |other|
         if obj = @resource.catalog.resource(@resource.class.name, other)
           unless obj.object_id == @resource.object_id
             self.fail("#{@resource.title} can not create alias #{other}: object already exists")
           end
           next
         end
 
         # Newschool, add it to the catalog.
         @resource.catalog.alias(@resource, other)
       end
     end
   end
 
   newmetaparam(:tag) do
     desc "Add the specified tags to the associated resource.  While all resources
       are automatically tagged with as much information as possible
       (e.g., each class and definition containing the resource), it can
       be useful to add your own tags to a given resource.
 
       Tags are currently useful for things like applying a subset of a
       host's configuration:
 
           puppet agent --test --tags mytag
 
       This way, when you're testing a configuration you can run just the
       portion you're testing."
 
     munge do |tags|
       tags = [tags] unless tags.is_a? Array
 
       tags.each do |tag|
         @resource.tag(tag)
       end
     end
   end
 
   class RelationshipMetaparam < Puppet::Parameter
     class << self
       attr_accessor :direction, :events, :callback, :subclasses
     end
 
     @subclasses = []
 
     def self.inherited(sub)
       @subclasses << sub
     end
 
     def munge(references)
       references = [references] unless references.is_a?(Array)
       references.collect do |ref|
         if ref.is_a?(Puppet::Resource)
           ref
         else
           Puppet::Resource.new(ref)
         end
       end
     end
 
     def validate_relationship
       @value.each do |ref|
         unless @resource.catalog.resource(ref.to_s)
           description = self.class.direction == :in ? "dependency" : "dependent"
           fail "Could not find #{description} #{ref} for #{resource.ref}"
         end
       end
     end
 
     # Create edges from each of our relationships.    :in
     # relationships are specified by the event-receivers, and :out
     # relationships are specified by the event generator.  This
     # way 'source' and 'target' are consistent terms in both edges
     # and events -- that is, an event targets edges whose source matches
     # the event's source.  The direction of the relationship determines
     # which resource is applied first and which resource is considered
     # to be the event generator.
     def to_edges
       @value.collect do |reference|
         reference.catalog = resource.catalog
 
         # Either of the two retrieval attempts could have returned
         # nil.
         unless related_resource = reference.resolve
           self.fail "Could not retrieve dependency '#{reference}' of #{@resource.ref}"
         end
 
         # Are we requiring them, or vice versa?  See the method docs
         # for futher info on this.
         if self.class.direction == :in
           source = related_resource
           target = @resource
         else
           source = @resource
           target = related_resource
         end
 
         if method = self.class.callback
           subargs = {
             :event => self.class.events,
             :callback => method
           }
           self.debug("subscribes to #{related_resource.ref}")
         else
           # If there's no callback, there's no point in even adding
           # a label.
           subargs = nil
           self.debug("requires #{related_resource.ref}")
         end
 
         rel = Puppet::Relationship.new(source, target, subargs)
       end
     end
   end
 
   def self.relationship_params
     RelationshipMetaparam.subclasses
   end
 
 
   # Note that the order in which the relationships params is defined
   # matters.  The labelled params (notify and subcribe) must be later,
   # so that if both params are used, those ones win.  It's a hackish
   # solution, but it works.
 
   newmetaparam(:require, :parent => RelationshipMetaparam, :attributes => {:direction => :in, :events => :NONE}) do
     desc "One or more objects that this object depends on.
       This is used purely for guaranteeing that changes to required objects
       happen before the dependent object.  For instance:
 
           # Create the destination directory before you copy things down
           file { \"/usr/local/scripts\":
             ensure => directory
           }
 
           file { \"/usr/local/scripts/myscript\":
             source => \"puppet://server/module/myscript\",
             mode => 755,
             require => File[\"/usr/local/scripts\"]
           }
 
       Multiple dependencies can be specified by providing a comma-seperated list
       of resources, enclosed in square brackets:
 
           require => [ File[\"/usr/local\"], File[\"/usr/local/scripts\"] ]
 
       Note that Puppet will autorequire everything that it can, and
       there are hooks in place so that it's easy for resources to add new
       ways to autorequire objects, so if you think Puppet could be
       smarter here, let us know.
 
       In fact, the above code was redundant -- Puppet will autorequire
       any parent directories that are being managed; it will
       automatically realize that the parent directory should be created
       before the script is pulled down.
 
       Currently, exec resources will autorequire their CWD (if it is
       specified) plus any fully qualified paths that appear in the
       command.   For instance, if you had an `exec` command that ran
       the `myscript` mentioned above, the above code that pulls the
       file down would be automatically listed as a requirement to the
       `exec` code, so that you would always be running againts the
       most recent version.
       "
   end
 
   newmetaparam(:subscribe, :parent => RelationshipMetaparam, :attributes => {:direction => :in, :events => :ALL_EVENTS, :callback => :refresh}) do
     desc "One or more objects that this object depends on.  Changes in the
       subscribed to objects result in the dependent objects being
       refreshed (e.g., a service will get restarted).  For instance:
 
           class nagios {
             file { \"/etc/nagios/nagios.conf\":
               source => \"puppet://server/module/nagios.conf\",
               alias => nagconf # just to make things easier for me
             }
             service { nagios:
               ensure => running,
               subscribe => File[nagconf]
             }
           }
 
       Currently the `exec`, `mount` and `service` type support
       refreshing.
       "
   end
 
   newmetaparam(:before, :parent => RelationshipMetaparam, :attributes => {:direction => :out, :events => :NONE}) do
     desc %{This parameter is the opposite of **require** -- it guarantees
       that the specified object is applied later than the specifying
       object:
 
           file { "/var/nagios/configuration":
             source  => "...",
             recurse => true,
             before => Exec["nagios-rebuid"]
           }
 
           exec { "nagios-rebuild":
             command => "/usr/bin/make",
             cwd => "/var/nagios/configuration"
           }
 
       This will make sure all of the files are up to date before the
       make command is run.}
   end
 
   newmetaparam(:notify, :parent => RelationshipMetaparam, :attributes => {:direction => :out, :events => :ALL_EVENTS, :callback => :refresh}) do
     desc %{This parameter is the opposite of **subscribe** -- it sends events
       to the specified object:
 
           file { "/etc/sshd_config":
             source => "....",
             notify => Service[sshd]
           }
 
           service { sshd:
             ensure => running
           }
 
       This will restart the sshd service if the sshd config file changes.}
   end
 
   newmetaparam(:stage) do
     desc %{Which run stage a given resource should reside in.  This just creates
       a dependency on or from the named milestone.  For instance, saying that
       this is in the 'bootstrap' stage creates a dependency on the 'bootstrap'
       milestone.
 
       By default, all classes get directly added to the
       'main' stage.  You can create new stages as resources:
 
           stage { [pre, post]: }
 
       To order stages, use standard relationships:
 
           stage { pre: before => Stage[main] }
 
       Or use the new relationship syntax:
 
           Stage[pre] -> Stage[main] -> Stage[post]
 
       Then use the new class parameters to specify a stage:
 
           class { foo: stage => pre }
 
       Stages can only be set on classes, not individual resources.  This will
       fail:
 
           file { '/foo': stage => pre, ensure => file }
     }
   end
 
   ###############################
   # All of the provider plumbing for the resource types.
   require 'puppet/provider'
   require 'puppet/util/provider_features'
 
   # Add the feature handling module.
   extend Puppet::Util::ProviderFeatures
 
   attr_reader :provider
 
   # the Type class attribute accessors
   class << self
     attr_accessor :providerloader
     attr_writer :defaultprovider
   end
 
   # Find the default provider.
   def self.defaultprovider
     unless @defaultprovider
       suitable = suitableprovider
 
       # Find which providers are a default for this system.
       defaults = suitable.find_all { |provider| provider.default? }
 
       # If we don't have any default we use suitable providers
       defaults = suitable if defaults.empty?
       max = defaults.collect { |provider| provider.specificity }.max
       defaults = defaults.find_all { |provider| provider.specificity == max }
 
       retval = nil
       if defaults.length > 1
         Puppet.warning(
           "Found multiple default providers for #{self.name}: #{defaults.collect { |i| i.name.to_s }.join(", ")}; using #{defaults[0].name}"
         )
         retval = defaults.shift
       elsif defaults.length == 1
         retval = defaults.shift
       else
         raise Puppet::DevError, "Could not find a default provider for #{self.name}"
       end
 
       @defaultprovider = retval
     end
 
     @defaultprovider
   end
 
   def self.provider_hash_by_type(type)
     @provider_hashes ||= {}
     @provider_hashes[type] ||= {}
   end
 
   def self.provider_hash
     Puppet::Type.provider_hash_by_type(self.name)
   end
 
   # Retrieve a provider by name.
   def self.provider(name)
     name = Puppet::Util.symbolize(name)
 
     # If we don't have it yet, try loading it.
     @providerloader.load(name) unless provider_hash.has_key?(name)
     provider_hash[name]
   end
 
   # Just list all of the providers.
   def self.providers
     provider_hash.keys
   end
 
   def self.validprovider?(name)
     name = Puppet::Util.symbolize(name)
 
     (provider_hash.has_key?(name) && provider_hash[name].suitable?)
   end
 
   # Create a new provider of a type.  This method must be called
   # directly on the type that it's implementing.
   def self.provide(name, options = {}, &block)
     name = Puppet::Util.symbolize(name)
 
     if obj = provider_hash[name]
       Puppet.debug "Reloading #{name} #{self.name} provider"
       unprovide(name)
     end
 
     parent = if pname = options[:parent]
       options.delete(:parent)
       if pname.is_a? Class
         pname
       else
         if provider = self.provider(pname)
           provider
         else
           raise Puppet::DevError,
             "Could not find parent provider #{pname} of #{name}"
         end
       end
     else
       Puppet::Provider
     end
 
     options[:resource_type] ||= self
 
     self.providify
 
 
       provider = genclass(
         name,
       :parent => parent,
       :hash => provider_hash,
       :prefix => "Provider",
       :block => block,
       :include => feature_module,
       :extend => feature_module,
 
       :attributes => options
     )
 
     provider
   end
 
   # Make sure we have a :provider parameter defined.  Only gets called if there
   # are providers.
   def self.providify
     return if @paramhash.has_key? :provider
 
     newparam(:provider) do
       desc "The specific backend for #{self.name.to_s} to use. You will
         seldom need to specify this -- Puppet will usually discover the
         appropriate provider for your platform."
 
       # This is so we can refer back to the type to get a list of
       # providers for documentation.
       class << self
         attr_accessor :parenttype
       end
 
       # We need to add documentation for each provider.
       def self.doc
         @doc + "  Available providers are:\n\n" + parenttype.providers.sort { |a,b|
           a.to_s <=> b.to_s
         }.collect { |i|
           "* **#{i}**: #{parenttype().provider(i).doc}"
         }.join("\n")
       end
 
       defaultto {
         @resource.class.defaultprovider.name
       }
 
       validate do |provider_class|
         provider_class = provider_class[0] if provider_class.is_a? Array
         provider_class = provider_class.class.name if provider_class.is_a?(Puppet::Provider)
 
         unless provider = @resource.class.provider(provider_class)
           raise ArgumentError, "Invalid #{@resource.class.name} provider '#{provider_class}'"
         end
       end
 
       munge do |provider|
         provider = provider[0] if provider.is_a? Array
         provider = provider.intern if provider.is_a? String
         @resource.provider = provider
 
         if provider.is_a?(Puppet::Provider)
           provider.class.name
         else
           provider
         end
       end
     end.parenttype = self
   end
 
   def self.unprovide(name)
     if provider_hash.has_key? name
 
       rmclass(
         name,
         :hash => provider_hash,
 
         :prefix => "Provider"
       )
       if @defaultprovider and @defaultprovider.name == name
         @defaultprovider = nil
       end
     end
   end
 
   # Return an array of all of the suitable providers.
   def self.suitableprovider
     providerloader.loadall if provider_hash.empty?
     provider_hash.find_all { |name, provider|
       provider.suitable?
     }.collect { |name, provider|
       provider
     }.reject { |p| p.name == :fake } # For testing
   end
 
   def provider=(name)
     if name.is_a?(Puppet::Provider)
       @provider = name
       @provider.resource = self
     elsif klass = self.class.provider(name)
       @provider = klass.new(self)
     else
       raise ArgumentError, "Could not find #{name} provider of #{self.class.name}"
     end
   end
 
   ###############################
   # All of the relationship code.
 
   # Specify a block for generating a list of objects to autorequire.  This
   # makes it so that you don't have to manually specify things that you clearly
   # require.
   def self.autorequire(name, &block)
     @autorequires ||= {}
     @autorequires[name] = block
   end
 
   # Yield each of those autorequires in turn, yo.
   def self.eachautorequire
     @autorequires ||= {}
     @autorequires.each { |type, block|
       yield(type, block)
     }
   end
 
   # Figure out of there are any objects we can automatically add as
   # dependencies.
   def autorequire(rel_catalog = nil)
     rel_catalog ||= catalog
     raise(Puppet::DevError, "You cannot add relationships without a catalog") unless rel_catalog
 
     reqs = []
     self.class.eachautorequire { |type, block|
       # Ignore any types we can't find, although that would be a bit odd.
       next unless typeobj = Puppet::Type.type(type)
 
       # Retrieve the list of names from the block.
       next unless list = self.instance_eval(&block)
       list = [list] unless list.is_a?(Array)
 
       # Collect the current prereqs
       list.each { |dep|
         obj = nil
         # Support them passing objects directly, to save some effort.
         unless dep.is_a? Puppet::Type
           # Skip autorequires that we aren't managing
           unless dep = rel_catalog.resource(type, dep)
             next
           end
         end
 
         reqs << Puppet::Relationship.new(dep, self)
       }
     }
 
     reqs
   end
 
   # Build the dependencies associated with an individual object.
   def builddepends
     # Handle the requires
     self.class.relationship_params.collect do |klass|
       if param = @parameters[klass.name]
         param.to_edges
       end
     end.flatten.reject { |r| r.nil? }
   end
 
   # Define the initial list of tags.
   def tags=(list)
     tag(self.class.name)
     tag(*list)
   end
 
   # Types (which map to resources in the languages) are entirely composed of
   # attribute value pairs.  Generally, Puppet calls any of these things an
   # 'attribute', but these attributes always take one of three specific
   # forms:  parameters, metaparams, or properties.
 
   # In naming methods, I have tried to consistently name the method so
   # that it is clear whether it operates on all attributes (thus has 'attr' in
   # the method name, or whether it operates on a specific type of attributes.
   attr_writer :title
   attr_writer :noop
 
   include Enumerable
 
   # class methods dealing with Type management
 
   public
 
   # the Type class attribute accessors
   class << self
     attr_reader :name
     attr_accessor :self_refresh
     include Enumerable, Puppet::Util::ClassGen
     include Puppet::MetaType::Manager
 
     include Puppet::Util
     include Puppet::Util::Logging
   end
 
   # all of the variables that must be initialized for each subclass
   def self.initvars
     # all of the instances of this class
     @objects = Hash.new
     @aliases = Hash.new
 
     @defaults = {}
 
     @parameters ||= []
 
     @validproperties = {}
     @properties = []
     @parameters = []
     @paramhash = {}
 
     @attr_aliases = {}
 
     @paramdoc = Hash.new { |hash,key|
       key = key.intern if key.is_a?(String)
       if hash.include?(key)
         hash[key]
       else
         "Param Documentation for #{key} not found"
       end
     }
 
     @doc ||= ""
 
   end
 
   def self.to_s
     if defined?(@name)
       "Puppet::Type::#{@name.to_s.capitalize}"
     else
       super
     end
   end
 
   # Create a block to validate that our object is set up entirely.  This will
   # be run before the object is operated on.
   def self.validate(&block)
     define_method(:validate, &block)
     #@validate = block
   end
 
   # The catalog that this resource is stored in.
   attr_accessor :catalog
 
   # is the resource exported
   attr_accessor :exported
 
   # is the resource virtual (it should not :-))
   attr_accessor :virtual
 
   # create a log at specified level
   def log(msg)
 
     Puppet::Util::Log.create(
 
       :level => @parameters[:loglevel].value,
       :message => msg,
 
       :source => self
     )
   end
 
 
   # instance methods related to instance intrinsics
   # e.g., initialize and name
 
   public
 
   attr_reader :original_parameters
 
   # initialize the type instance
   def initialize(resource)
     raise Puppet::DevError, "Got TransObject instead of Resource or hash" if resource.is_a?(Puppet::TransObject)
     resource = self.class.hash2resource(resource) unless resource.is_a?(Puppet::Resource)
 
     # The list of parameter/property instances.
     @parameters = {}
 
     # Set the title first, so any failures print correctly.
     if resource.type.to_s.downcase.to_sym == self.class.name
       self.title = resource.title
     else
       # This should only ever happen for components
       self.title = resource.ref
     end
 
     [:file, :line, :catalog, :exported, :virtual].each do |getter|
       setter = getter.to_s + "="
       if val = resource.send(getter)
         self.send(setter, val)
       end
     end
 
     @tags = resource.tags
 
     @original_parameters = resource.to_hash
 
     set_name(@original_parameters)
 
     set_default(:provider)
 
     set_parameters(@original_parameters)
 
     self.validate if self.respond_to?(:validate)
   end
 
   private
 
   # Set our resource's name.
   def set_name(hash)
     self[name_var] = hash.delete(name_var) if name_var
   end
 
   # Set all of the parameters from a hash, in the appropriate order.
   def set_parameters(hash)
     # Use the order provided by allattrs, but add in any
     # extra attributes from the resource so we get failures
     # on invalid attributes.
     no_values = []
     (self.class.allattrs + hash.keys).uniq.each do |attr|
       begin
         # Set any defaults immediately.  This is mostly done so
         # that the default provider is available for any other
         # property validation.
         if hash.has_key?(attr)
           self[attr] = hash[attr]
         else
           no_values << attr
         end
       rescue ArgumentError, Puppet::Error, TypeError
         raise
       rescue => detail
         error = Puppet::DevError.new( "Could not set #{attr} on #{self.class.name}: #{detail}")
         error.set_backtrace(detail.backtrace)
         raise error
       end
     end
     no_values.each do |attr|
       set_default(attr)
     end
   end
 
   public
 
   # Set up all of our autorequires.
   def finish
     # Make sure all of our relationships are valid.  Again, must be done
     # when the entire catalog is instantiated.
     self.class.relationship_params.collect do |klass|
       if param = @parameters[klass.name]
         param.validate_relationship
       end
     end.flatten.reject { |r| r.nil? }
   end
 
   # For now, leave the 'name' method functioning like it used to.  Once 'title'
   # works everywhere, I'll switch it.
   def name
     self[:name]
   end
 
   # Look up our parent in the catalog, if we have one.
   def parent
     return nil unless catalog
 
     unless defined?(@parent)
       if parents = catalog.adjacent(self, :direction => :in)
         # We should never have more than one parent, so let's just ignore
         # it if we happen to.
         @parent = parents.shift
       else
         @parent = nil
       end
     end
     @parent
   end
 
   # Return the "type[name]" style reference.
   def ref
     "#{self.class.name.to_s.capitalize}[#{self.title}]"
   end
 
   def self_refresh?
     self.class.self_refresh
   end
 
   # Mark that we're purging.
   def purging
     @purging = true
   end
 
   # Is this resource being purged?  Used by transactions to forbid
   # deletion when there are dependencies.
   def purging?
     if defined?(@purging)
       @purging
     else
       false
     end
   end
 
   # Retrieve the title of an object.  If no title was set separately,
   # then use the object's name.
   def title
     unless @title
       if self.class.validparameter?(name_var)
         @title = self[:name]
       elsif self.class.validproperty?(name_var)
         @title = self.should(name_var)
       else
         self.devfail "Could not find namevar #{name_var} for #{self.class.name}"
       end
     end
 
     @title
   end
 
   # convert to a string
   def to_s
     self.ref
   end
 
   # Convert to a transportable object
   def to_trans(ret = true)
     trans = TransObject.new(self.title, self.class.name)
 
     values = retrieve_resource
     values.each do |name, value|
       name = name.name if name.respond_to? :name
       trans[name] = value
     end
 
     @parameters.each do |name, param|
       # Avoid adding each instance name twice
       next if param.class.isnamevar? and param.value == self.title
 
       # We've already got property values
       next if param.is_a?(Puppet::Property)
       trans[name] = param.value
     end
 
     trans.tags = self.tags
 
     # FIXME I'm currently ignoring 'parent' and 'path'
 
     trans
   end
 
   def to_resource
     # this 'type instance' versus 'resource' distinction seems artificial
     # I'd like to see it collapsed someday ~JW
     self.to_trans.to_resource
   end
 
   def virtual?;  !!@virtual;  end
   def exported?; !!@exported; end
 end
 end
 
 require 'puppet/provider'
 
 # Always load these types.
 require 'puppet/type/component'
diff --git a/lib/puppet/util/command_line/filebucket b/lib/puppet/util/command_line/filebucket
deleted file mode 100755
index 34b01508e..000000000
--- a/lib/puppet/util/command_line/filebucket
+++ /dev/null
@@ -1,97 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# = Synopsis
-#
-# A stand-alone Puppet filebucket client.
-#
-# = Usage
-#
-#   puppet filebucket [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
-#      [-l|--local] [-r|--remote]
-#      [-s|--server <server>] [-b|--bucket <directory>] <file> <file> ...
-#
-# = Description
-#
-# This is a stand-alone filebucket client for sending files to a local
-# or central filebucket.
-#
-# = Usage
-#
-# This client can operate in three modes, with only one mode per call:
-#
-# backup::
-#   Send one or more files to the specified file bucket.  Each sent file
-#   is printed with its resulting md5 sum.
-#
-# get::
-#   Return the text associated with an md5 sum.  The text is printed to
-#   stdout, and only one file can be retrieved at a time.
-#
-# restore::
-#   Given a file path and an md5 sum, store the content associated with the
-#   sum into the specified file path.  You can specify an entirely new path
-#   to this argument; you are not restricted to restoring the content to its
-#   original location.
-#
-# Note that +filebucket+ defaults to using a network-based filebucket available on
-# the server named +puppet+.  To use this, you'll have to be running as a user
-# with valid Puppet certificates.  Alternatively, you can use your local file bucket
-# by specifying +--local+.
-#
-# = Example
-#
-#   $ puppet filebucket backup /etc/passwd
-#   /etc/passwd: 429b225650b912a2ee067b0a4cf1e949
-#   $ puppet filebucket restore /tmp/passwd 429b225650b912a2ee067b0a4cf1e949
-#   $
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'ssldir' is a valid configuration
-# parameter, so you can specify '--ssldir <directory>' as an argument.
-#
-# See the configuration file documentation at
-# http://docs.puppetlabs.com/references/stable/configuration.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppet with
-# '--genconfig'.
-#
-# debug::
-#   Enable full debugging.
-#
-# help::
-#   Print this help message
-#
-# local::
-#   Use the local filebucket.  This will use the default configuration
-#   information.
-#
-# remote::
-#   Use a remote filebucket.  This will use the default configuration
-#   information.
-#
-# server::
-#   The server to send the file to, instead of locally.
-#
-# verbose::
-#   Print extra information.
-#
-# version::
-#   Print version information.
-#
-# = Example
-#
-#   puppet filebucket -b /tmp/filebucket /my/file
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:filebucket].run
diff --git a/lib/puppet/util/command_line/pi b/lib/puppet/util/command_line/pi
deleted file mode 100755
index 3d80eea8f..000000000
--- a/lib/puppet/util/command_line/pi
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# = Synopsis
-#
-# Print help about puppet types on the console. Run with '-h' to get detailed
-# help.
-# = Usage
-#
-#   puppet describe [-h|--help] [-s|--short] [-p|--providers] [-l|--list] [-m|--meta]
-#
-# = Description
-#
-# Prints details of Puppet types, providers and metaparameters on the console.
-#
-# = Options
-#
-# help::
-#   Print this help text
-#
-# providers::
-#   Describe providers in detail for each type
-#
-# list::
-#   List all types
-#
-# meta::
-#   List all metaparameters
-#
-# short::
-#   List only parameters without detail 
-#
-# = Example
-#
-#   puppet describe --list
-#   puppet describe file --providers
-#   puppet describe user -s -m
-#
-# = Author
-#
-# David Lutterkort
-#
-# = Copyright
-#
-# Copyright (c) 2005 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:describe].run
diff --git a/lib/puppet/util/command_line/puppet b/lib/puppet/util/command_line/puppet
deleted file mode 100755
index e75b92af8..000000000
--- a/lib/puppet/util/command_line/puppet
+++ /dev/null
@@ -1,69 +0,0 @@
-
-#
-# = Synopsis
-#
-# Run a stand-alone +puppet+ manifest.
-#
-# = Usage
-#
-#   puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose] [-e|--execute]
-#               [--detailed-exitcodes] [-l|--logdest <file>] <file>
-#
-# = Description
-#
-# This is the standalone puppet execution tool; use it to execute
-# individual manifests that you write.  If you need to execute site-wide
-# manifests, use 'puppet agent' and 'puppet master'.
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'ssldir' is a valid configuration
-# parameter, so you can specify '--ssldir <directory>' as an argument.
-#
-# See the configuration file documentation at
-# http://docs.puppetlabs.com/references/stable/configuration.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppet with
-# '--genconfig'.
-#
-# debug::
-#   Enable full debugging.
-#
-# detailed-exitcodes::
-#   Provide transaction information via exit codes.  If this is enabled, an exit
-#   code of '2' means there were changes, and an exit code of '4' means that there
-#   were failures during the transaction.
-#
-# help::
-#   Print this help message
-#
-# loadclasses::
-#   Load any stored classes. 'puppet agent' caches configured classes (usually at
-#   /etc/puppet/classes.txt), and setting this option causes all of those classes
-#   to be set in your puppet manifest.
-#
-# logdest::
-#   Where to send messages.  Choose between syslog, the console, and a log file.
-#   Defaults to sending messages to the console.
-#
-# execute::
-#   Execute a specific piece of Puppet code
-#
-# verbose::
-#   Print extra information.
-#
-# = Example
-#
-#   puppet -l /tmp/manifest.log manifest.pp
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:apply].run
diff --git a/lib/puppet/util/command_line/puppetca b/lib/puppet/util/command_line/puppetca
deleted file mode 100755
index 317d99881..000000000
--- a/lib/puppet/util/command_line/puppetca
+++ /dev/null
@@ -1,110 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# = Synopsis
-#
-# Stand-alone certificate authority.  Capable of generating certificates
-# but mostly meant for signing certificate requests from puppet clients.
-#
-# = Usage
-#
-#   puppet cert [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
-#               [-g|--generate] [-l|--list] [-s|--sign] [-r|--revoke]
-#               [-p|--print] [-c|--clean] [--verify] [--digest DIGEST]
-#               [--fingerprint] [host]
-#
-# = Description
-#
-# Because the puppetmasterd daemon defaults to not signing client certificate
-# requests, this script is available for signing outstanding requests.  It
-# can be used to list outstanding requests and then either sign them individually
-# or sign all of them.
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'ssldir' is a valid configuration
-# parameter, so you can specify '--ssldir <directory>' as an argument.
-#
-# See the configuration file documentation at
-# http://docs.puppetlabs.com/references/stable/configuration.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppet cert with
-# '--genconfig'.
-#
-# all::
-#   Operate on all items.  Currently only makes sense with '--sign',
-#   '--clean', or '--list'.
-#
-# digest::
-#   Set the digest for fingerprinting (defaults to md5). Valid values depends
-#   on your openssl and openssl ruby extension version, but should contain at
-#   least md5, sha1, md2, sha256.
-#
-# clean::
-#    Remove all files related to a host from puppet cert's storage. This is
-#    useful when rebuilding hosts, since new certificate signing requests
-#    will only be honored if puppet cert does not have a copy of a signed
-#    certificate for that host. The certificate of the host is also revoked.
-#    If '--all' is specified then all host certificates, both signed and
-#    unsigned, will be removed.
-#
-# debug::
-#   Enable full debugging.
-#
-# generate::
-#   Generate a certificate for a named client.  A certificate/keypair will be
-#   generated for each client named on the command line.
-#
-# help::
-#   Print this help message
-#
-# list::
-#   List outstanding certificate requests.  If '--all' is specified,
-#   signed certificates are also listed, prefixed by '+', and revoked
-#   or invalid certificates are prefixed by '-' (the verification outcome
-#   is printed in parenthesis).
-#
-# print::
-#   Print the full-text version of a host's certificate.
-#
-# fingerprint::
-#   Print the DIGEST (defaults to md5) fingerprint of a host's certificate.
-#
-# revoke::
-#   Revoke the certificate of a client. The certificate can be specified
-#   either by its serial number, given as a decimal number or a hexadecimal
-#   number prefixed by '0x', or by its hostname. The certificate is revoked
-#   by adding it to the Certificate Revocation List given by the 'cacrl'
-#   config parameter. Note that the puppetmasterd needs to be restarted
-#   after revoking certificates.
-#
-# sign::
-#   Sign an outstanding certificate request.  Unless '--all' is specified,
-#   hosts must be listed after all flags.
-#
-# verbose::
-#   Enable verbosity.
-#
-# version::
-#   Print the puppet version number and exit.
-#
-# verify::
-#   Verify the named certificate against the local CA certificate.
-#
-# = Example
-#
-#   $ puppet cert -l
-#   culain.madstop.com
-#   $ puppet cert -s culain.madstop.com
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:cert].run
diff --git a/lib/puppet/util/command_line/puppetd b/lib/puppet/util/command_line/puppetd
deleted file mode 100755
index 71b28429b..000000000
--- a/lib/puppet/util/command_line/puppetd
+++ /dev/null
@@ -1,188 +0,0 @@
-#!/usr/bin/env ruby
-
-# == Synopsis
-#
-# Retrieve the client configuration from the puppet master and apply
-# it to the local host.
-#
-# Currently must be run out periodically, using cron or something similar.
-#
-# = Usage
-#
-#   puppet agent  [-D|--daemonize|--no-daemonize] [-d|--debug]
-#       [--detailed-exitcodes] [--disable] [--enable]
-#       [-h|--help] [--certname <host name>] [-l|--logdest syslog|<file>|console]
-#       [-o|--onetime] [--serve <handler>] [-t|--test] [--noop]
-#       [--digest <digest>] [--fingerprint] [-V|--version]
-#       [-v|--verbose] [-w|--waitforcert <seconds>]
-#
-# = Description
-#
-# This is the main puppet client.  Its job is to retrieve the local machine's
-# configuration from a remote server and apply it.  In order to successfully
-# communicate with the remote server, the client must have a certificate signed
-# by a certificate authority that the server trusts; the recommended method
-# for this, at the moment, is to run a certificate authority as part of the
-# puppet server (which is the default).  The client will connect and request
-# a signed certificate, and will continue connecting until it receives one.
-#
-# Once the client has a signed certificate, it will retrieve its configuration
-# and apply it.
-#
-# = Usage Notes
-#
-# +puppet agent+ does its best to find a compromise between interactive use and
-# daemon use.  Run with no arguments and no configuration, it will go into the
-# backgroun, attempt to get a signed certificate, and retrieve and apply its
-# configuration every 30 minutes.
-#
-# Some flags are meant specifically for interactive use -- in particular,
-# +test+, +tags+ or +fingerprint+ are useful. +test+ enables verbose logging, causes
-# the daemon to stay in the foreground, exits if the server's configuration is
-# invalid (this happens if, for instance, you've left a syntax error on the
-# server), and exits after running the configuration once (rather than hanging
-# around as a long-running process).
-#
-# +tags+ allows you to specify what portions of a configuration you want to apply.
-# Puppet elements are tagged with all of the class or definition names that
-# contain them, and you can use the +tags+ flag to specify one of these names,
-# causing only configuration elements contained within that class or definition
-# to be applied.  This is very useful when you are testing new configurations --
-# for instance, if you are just starting to manage +ntpd+, you would put all of
-# the new elements into an +ntpd+ class, and call puppet with +--tags ntpd+,
-# which would only apply that small portion of the configuration during your
-# testing, rather than applying the whole thing.
-#
-# +fingerprint+ is a one-time flag. In this mode +puppet agent+ will run once and
-# display on the console (and in the log) the current certificate (or certificate
-# request) fingerprint. Providing the +--digest+ option allows to use a different
-# digest algorithm to generate the fingerprint. The main use is to verify that
-# before signing a certificate request on the master, the certificate request the
-# master received is the same as the one the client sent (to prevent against
-# man-in-the-middle attacks when signing certificates).
-# 
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'server' is a valid configuration
-# parameter, so you can specify '--server <servername>' as an argument.
-#
-# See the configuration file documentation at
-# http://docs.puppetlabs.com/references/stable/configuration.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppet agent with
-# '--genconfig'.
-#
-# daemonize::
-#   Send the process into the background.  This is the default.
-#
-# no-daemonize::
-#   Do not send the process into the background.
-#
-# debug::
-#   Enable full debugging.
-#
-# digest::
-#   Change the certificate fingerprinting digest algorithm. The default is MD5.
-#   Valid values depends on the version of OpenSSL installed, but should always
-#   at least contain MD5, MD2, SHA1 and SHA256.
-#
-# detailed-exitcodes::
-#   Provide transaction information via exit codes.  If this is enabled, an
-#   exit code of '2' means there were changes, and an exit code of '4' means
-#   that there were failures during the transaction. This option only makes
-#   sense in conjunction with --onetime.
-#
-# disable::
-#   Disable working on the local system.  This puts a lock file in place,
-#   causing +puppet agent+ not to work on the system until the lock file is removed.
-#   This is useful if you are testing a configuration and do not want the central
-#   configuration to override the local state until everything is tested and
-#   committed.
-#
-#   +puppet agent+ uses the same lock file while it is running, so no more than one
-#   +puppet agent+ process is working at a time.
-#
-#   +puppet agent+ exits after executing this.
-#
-# enable::
-#   Enable working on the local system.  This removes any lock file, causing
-#   +puppet agent+ to start managing the local system again (although it will continue
-#   to use its normal scheduling, so it might not start for another half hour).
-#
-#   +puppet agent+ exits after executing this.
-#
-# certname::
-#   Set the certname (unique ID) of the client. The master reads this unique
-#   identifying string, which is usually set to the node's fully-qualified domain
-#   name, to determine which configurations the node will receive. Use this option
-#   to debug setup problems or implement unusual node identification schemes.
-#
-# help::
-#   Print this help message
-#
-# logdest::
-#   Where to send messages.  Choose between syslog, the console, and a log file.
-#   Defaults to sending messages to syslog, or the console if debugging or
-#   verbosity is enabled.
-#
-# no-client::
-#   Do not create a config client.  This will cause the daemon to run
-#   without ever checking for its configuration automatically, and only
-#   makes sense when used in conjunction with --listen.
-#
-# onetime::
-#   Run the configuration once. Runs a single (normally daemonized) Puppet run. 
-#   Useful for interactively running puppet agent when used in conjunction with 
-#   the --no-daemonize option.
-#
-# fingerprint::
-#   Display the current certificate or certificate signing request fingerprint
-#   and then exit. Use the +--digest+ option to change the digest algorithm used.
-#
-# serve::
-#   Start another type of server.  By default, +puppet agent+ will start
-#   a service handler that allows authenticated and authorized remote nodes to
-#   trigger the configuration to be pulled down and applied.  You can specify
-#   any handler here that does not require configuration, e.g., filebucket, ca,
-#   or resource.  The handlers are in +lib/puppet/network/handler+, and the names
-#   must match exactly, both in the call to +serve+ and in +namespaceauth.conf+.
-#
-# test::
-#   Enable the most common options used for testing.  These are +onetime+,
-#   +verbose+, +ignorecache, +no-daemonize+, +no-usecacheonfailure+,
-#   +detailed-exit-codes+, +no-splay+, and +show_diff+.
-#
-# noop::
-#   Use +noop+ mode where the daemon runs in a no-op or dry-run mode.  This is useful
-#   for seeing what changes Puppet will make without actually executing the changes.
-#
-# verbose::
-#   Turn on verbose reporting.
-#
-# version::
-#   Print the puppet version number and exit.
-#
-# waitforcert::
-#   This option only matters for daemons that do not yet have certificates
-#   and it is enabled by default, with a value of 120 (seconds).  This causes
-#   +puppet agent+ to connect to the server every 2 minutes and ask it to sign a
-#   certificate request.  This is useful for the initial setup of a puppet
-#   client.  You can turn off waiting for certificates by specifying a time
-#   of 0.
-#
-# = Example
-#
-#   puppet agent --server puppet.domain.com
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005, 2006 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:agent].run
diff --git a/lib/puppet/util/command_line/puppetdoc b/lib/puppet/util/command_line/puppetdoc
deleted file mode 100755
index 45a9c6518..000000000
--- a/lib/puppet/util/command_line/puppetdoc
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# = Synopsis
-#
-# Generate a reference for all Puppet types.  Largely meant for internal Puppet
-# Labs use.
-#
-# = Usage
-#
-#   puppet doc [-a|--all] [-h|--help] [-o|--outputdir <rdoc outputdir>] [-m|--mode <text|pdf|rdoc>]
-#              [-r|--reference <[type]|configuration|..>] [--charset CHARSET] [manifest-file]
-#
-# = Description
-#
-# If mode is not 'rdoc', then this command generates a Markdown document describing all installed
-# Puppet types or all allowable arguments to puppet executables.  It is largely
-# meant for internal use and is used to generate the reference document
-# available on the Puppet Labs web site.
-#
-# In 'rdoc' mode, this command generates an html RDoc hierarchy describing the manifests that
-# are in 'manifestdir' and 'modulepath' configuration directives.
-# The generated documentation directory is doc by default but can be changed with the 'outputdir' option.
-#
-# If the command is started with 'manifest-file' command-line arguments, puppet doc generate a single
-# manifest documentation that is output on stdout.
-#
-# = Options
-#
-# all::
-#   Output the docs for all of the reference types. In 'rdoc' modes, this also outputs documentation for all resources
-#
-# help::
-#   Print this help message
-#
-# outputdir::
-#   Specifies the directory where to output the rdoc documentation in 'rdoc' mode.
-#
-# mode::
-#   Determine the output mode.  Valid modes are 'text', 'pdf' and 'rdoc'. The 'pdf' mode creates PDF formatted files in the /tmp directory. The default mode is 'text'.  In 'rdoc' mode you must provide 'manifests-path'
-#
-# reference::
-#   Build a particular reference.  Get a list of references by running +puppet doc --list+.
-#
-# charset::
-#   Used only in 'rdoc' mode. It sets the charset used in the html files produced.
-#
-# = Example
-#
-#   $ puppet doc -r type > /tmp/type_reference.markdown
-# or
-#   $ puppet doc --outputdir /tmp/rdoc --mode rdoc /path/to/manifests
-# or
-#   $ puppet doc /etc/puppet/manifests/site.pp
-# or
-#   $ puppet doc -m pdf -r configuration
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005-2007 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:doc].run
diff --git a/lib/puppet/util/command_line/puppetmasterd b/lib/puppet/util/command_line/puppetmasterd
deleted file mode 100755
index 445169820..000000000
--- a/lib/puppet/util/command_line/puppetmasterd
+++ /dev/null
@@ -1,74 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# = Synopsis
-#
-# The central puppet server.  Functions as a certificate authority by default.
-#
-# = Usage
-#
-#   puppet master [-D|--daemonize|--no-daemonize] [-d|--debug] [-h|--help]
-#       [-l|--logdest <file>|console|syslog] [-v|--verbose] [-V|--version]
-#       [--compile <nodename>] [--apply <catalog>]
-#
-# = Description
-#
-# This is the puppet central daemon.
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'ssldir' is a valid configuration
-# parameter, so you can specify '--ssldir <directory>' as an argument.
-#
-# See the configuration file documentation at
-# http://docs.puppetlabs.com/references/stable/configuration.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppetmasterdd with
-# '--genconfig'.
-#
-# daemonize::
-#   Send the process into the background.  This is the default.
-#
-# no-daemonize::
-#   Do not send the process into the background.
-#
-# debug::
-#   Enable full debugging.
-#
-# help::
-#   Print this help message.
-#
-# logdest::
-#   Where to send messages.  Choose between syslog, the console, and a log file.
-#   Defaults to sending messages to syslog, or the console
-#   if debugging or verbosity is enabled.
-#
-# verbose::
-#   Enable verbosity.
-#
-# version::
-#   Print the puppet version number and exit.
-#
-# compile::
-#   Capability to compile a catalogue and output it in JSON from the Puppet master. Uses 
-#   facts contained in the $vardir/yaml/ directory to compile the catalog.
-# 
-# apply::
-#   Capability to apply JSON catalog (such as one generated with --compile). You can either specify 
-#   a JSON file or pipe in JSON from standard input.
-#
-# = Example
-#
-#   puppet master
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:master].run
diff --git a/lib/puppet/util/command_line/puppetqd b/lib/puppet/util/command_line/puppetqd
deleted file mode 100755
index 81963d537..000000000
--- a/lib/puppet/util/command_line/puppetqd
+++ /dev/null
@@ -1,53 +0,0 @@
-#!/usr/bin/env ruby
-
-# == Synopsis
-#
-# Retrieve serialized records from a queue and process them in order.
-#
-# = Usage
-#
-#   puppet queue [-d|--debug] [-v|--verbose]
-#
-# = Description
-#
-# This is a simple application that just processes entities in a queue as they
-# are recieved.
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'server' is a valid configuration
-# parameter, so you can specify '--server <servername>' as an argument.
-#
-# See the configuration file documentation at
-# http://docs.puppetlabs.com/references/stable/configuration.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppetd with
-# '--genconfig'.
-#
-# debug::
-#   Enable full debugging.
-#
-# help::
-#   Print this help message
-#
-# verbose::
-#   Turn on verbose reporting.
-#
-# version::
-#   Print the puppet version number and exit.
-#
-# = Example
-#
-#   puppet queue
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2009 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:queue].run
diff --git a/lib/puppet/util/command_line/puppetrun b/lib/puppet/util/command_line/puppetrun
deleted file mode 100755
index 7eba3b2c4..000000000
--- a/lib/puppet/util/command_line/puppetrun
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# = Synopsis
-#
-# Trigger a puppet agent run on a set of hosts.
-#
-# = Usage
-#
-#   puppet kick [-a|--all] [-c|--class <class>] [-d|--debug] [-f|--foreground]
-#       [-h|--help] [--host <host>] [--no-fqdn] [--ignoreschedules]
-#       [-t|--tag <tag>] [--test] [-p|--ping] <host> [<host> [...]]
-#
-# = Description
-#
-# This script can be used to connect to a set of machines running +puppet agent+
-# and trigger them to run their configurations.  The most common usage would
-# be to specify a class of hosts and a set of tags, and +puppet kick+ would
-# look up in LDAP all of the hosts matching that class, then connect to
-# each host and trigger a run of all of the objects with the specified tags.
-#
-# If you are not storing your host configurations in LDAP, you can specify
-# hosts manually.
-#
-# You will most likely have to run +puppet kick+ as root to get access to
-# the SSL certificates.
-#
-# +puppet kick+ reads +puppet master+'s configuration file, so that it can copy
-# things like LDAP settings.
-#
-# = Usage Notes
-#
-# +puppet kick+ is useless unless +puppet agent+ is listening.  See its documentation
-# for more information, but the gist is that you must enable +listen+ on the
-# +puppet agent+ daemon, either using +--listen+ on the command line or adding
-# 'listen: true' in its config file.  In addition, you need to set the daemons
-# up to specifically allow connections by creating the +namespaceauth+ file,
-# normally at '/etc/puppet/namespaceauth.conf'.  This file specifies who has
-# access to each namespace; if you create the file you must add every namespace
-# you want any Puppet daemon to allow -- it is currently global to all Puppet
-# daemons.
-#
-# An example file looks like this::
-#
-#     [fileserver]
-#         allow *.madstop.com
-#
-#     [puppetmaster]
-#         allow *.madstop.com
-#
-#     [puppetrunner]
-#         allow culain.madstop.com
-#
-# This is what you would install on your Puppet master; non-master hosts could
-# leave off the 'fileserver' and 'puppetmaster' namespaces.
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'ssldir' is a valid configuration
-# parameter, so you can specify '--ssldir <directory>' as an argument.
-#
-# See the configuration file documentation at
-# http://reductivelabs.com/projects/puppet/reference/configref.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppet master with
-# '--genconfig'.
-#
-#
-# all::
-#   Connect to all available hosts.  Requires LDAP support at this point.
-#
-# class::
-#   Specify a class of machines to which to connect.  This only works if you
-#   have LDAP configured, at the moment.
-#
-# debug::
-#   Enable full debugging.
-#
-# foreground::
-#   Run each configuration in the foreground; that is, when connecting to a host,
-#   do not return until the host has finished its run.  The default is false.
-#
-# help::
-#   Print this help message
-#
-# host::
-#   A specific host to which to connect.  This flag can be specified more
-#   than once.
-#
-# ignoreschedules::
-#   Whether the client should ignore schedules when running its configuration.
-#   This can be used to force the client to perform work it would not normally
-#   perform so soon.  The default is false.
-#
-# parallel::
-#   How parallel to make the connections.  Parallelization is provided by forking
-#   for each client to which to connect.  The default is 1, meaning serial execution.
-#
-# tag::
-#   Specify a tag for selecting the objects to apply. Does not work with the
-#   --test option.
-#
-#
-# test::
-#   Print the hosts you would connect to but do not actually connect. This
-#   option requires LDAP support at this point.
-#
-# ping::
-#
-#   Do a ICMP echo against the target host. Skip hosts that don't respond to ping.
-#
-# = Example
-#
-#   sudo puppet kick -p 10 -t remotefile -t webserver host1 host2
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:kick].run
diff --git a/lib/puppet/util/command_line/ralsh b/lib/puppet/util/command_line/ralsh
deleted file mode 100755
index 5c1f719e2..000000000
--- a/lib/puppet/util/command_line/ralsh
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# = Synopsis
-#
-# Use the Puppet RAL to directly interact with the system.
-#
-# = Usage
-#
-#   puppet resource [-h|--help] [-d|--debug] [-v|--verbose] [-e|--edit]
-#                   [-H|--host <host>] [-p|--param <param>] [-t|--types]
-#                   type <name>
-#
-# = Description
-#
-# This command provides simple facilities for converting current system state
-# into Puppet code, along with some ability to use Puppet to affect the current
-# state.
-#
-# By default, you must at least provide a type to list, which case puppet resource
-# will tell you everything it knows about all instances of that type.  You can
-# optionally specify an instance name, and puppet resource will only describe that single
-# instance.
-#
-# You can also add +--edit+ as an argument, and puppet resource will write its output
-# to a file, open that file in an editor, and then apply the file as a Puppet
-# transaction.  You can easily use this to use Puppet to make simple changes to
-# a system.
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'ssldir' is a valid configuration
-# parameter, so you can specify '--ssldir <directory>' as an argument.
-#
-# See the configuration file documentation at
-# http://docs.puppetlabs.com/references/stable/configuration.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppet with
-# '--genconfig'.
-#
-# debug::
-#   Enable full debugging.
-#
-# edit:
-#   Write the results of the query to a file, open the file in an editor,
-#   and read the file back in as an executable Puppet manifest.
-#
-# host:
-#   When specified, connect to the resource server on the named host
-#   and retrieve the list of resouces of the type specified.
-#
-# help:
-#   Print this help message.
-#
-# param:
-#   Add more parameters to be outputted from queries.
-#
-# types:
-#   List all available types.
-#
-# verbose:
-#   Print extra information.
-#
-# = Example
-#
-# This example uses `puppet resource` to return Puppet configuration for the user `luke`:
-#
-#      $ puppet resource user luke
-#      user { 'luke':
-#        home => '/home/luke',
-#        uid => '100',
-#        ensure => 'present',
-#        comment => 'Luke Kanies,,,',
-#        gid => '1000',
-#        shell => '/bin/bash',
-#        groups => ['sysadmin','audio','video','puppet']
-#      }
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005-2007 Puppet Labs, LLC
-# Licensed under the GNU Public License
-
-#Puppet::Application[:resource].run
diff --git a/lib/puppet/util/log.rb b/lib/puppet/util/log.rb
index 2f9f356bb..d34fbaf55 100644
--- a/lib/puppet/util/log.rb
+++ b/lib/puppet/util/log.rb
@@ -1,259 +1,265 @@
 require 'puppet/util/tagging'
 require 'puppet/util/classgen'
 
 # Pass feedback to the user.  Log levels are modeled after syslog's, and it is
 # expected that that will be the most common log destination.  Supports
 # multiple destinations, one of which is a remote server.
 class Puppet::Util::Log
   include Puppet::Util
   extend Puppet::Util::ClassGen
   include Puppet::Util::Tagging
 
   @levels = [:debug,:info,:notice,:warning,:err,:alert,:emerg,:crit]
   @loglevel = 2
 
   @desttypes = {}
 
   # Create a new destination type.
   def self.newdesttype(name, options = {}, &block)
 
     dest = genclass(
       name,
       :parent     => Puppet::Util::Log::Destination,
       :prefix     => "Dest",
       :block      => block,
       :hash       => @desttypes,
       :attributes => options
     )
     dest.match(dest.name)
 
     dest
   end
 
   require 'puppet/util/log/destination'
   require 'puppet/util/log/destinations'
 
   @destinations = {}
 
   @queued = []
 
   class << self
     include Puppet::Util
     include Puppet::Util::ClassGen
 
     attr_reader :desttypes
   end
 
   # Reset log to basics.  Basically just flushes and closes files and
   # undefs other objects.
   def Log.close(destination)
     if @destinations.include?(destination)
       @destinations[destination].flush if @destinations[destination].respond_to?(:flush)
       @destinations[destination].close if @destinations[destination].respond_to?(:close)
       @destinations.delete(destination)
     end
   end
 
   def self.close_all
     destinations.keys.each { |dest|
       close(dest)
     }
     raise Puppet::DevError.new("Log.close_all failed to close #{@destinations.keys.inspect}") if !@destinations.empty?
   end
 
   # Flush any log destinations that support such operations.
   def Log.flush
     @destinations.each { |type, dest|
       dest.flush if dest.respond_to?(:flush)
     }
   end
 
+  def Log.autoflush=(v)
+    @destinations.each do |type, dest|
+      dest.autoflush = v if dest.respond_to?(:autoflush=)
+    end
+  end
+
   # Create a new log message.  The primary role of this method is to
   # avoid creating log messages below the loglevel.
   def Log.create(hash)
     raise Puppet::DevError, "Logs require a level" unless hash.include?(:level)
     raise Puppet::DevError, "Invalid log level #{hash[:level]}" unless @levels.index(hash[:level])
     @levels.index(hash[:level]) >= @loglevel ? Puppet::Util::Log.new(hash) : nil
   end
 
   def Log.destinations
     @destinations
   end
 
   # Yield each valid level in turn
   def Log.eachlevel
     @levels.each { |level| yield level }
   end
 
   # Return the current log level.
   def Log.level
     @levels[@loglevel]
   end
 
   # Set the current log level.
   def Log.level=(level)
     level = level.intern unless level.is_a?(Symbol)
 
     raise Puppet::DevError, "Invalid loglevel #{level}" unless @levels.include?(level)
 
     @loglevel = @levels.index(level)
   end
 
   def Log.levels
     @levels.dup
   end
 
   # Create a new log destination.
   def Log.newdestination(dest)
     # Each destination can only occur once.
     if @destinations.find { |name, obj| obj.name == dest }
       return
     end
 
     name, type = @desttypes.find do |name, klass|
       klass.match?(dest)
     end
 
     raise Puppet::DevError, "Unknown destination type #{dest}" unless type
 
     begin
       if type.instance_method(:initialize).arity == 1
         @destinations[dest] = type.new(dest)
       else
         @destinations[dest] = type.new
       end
       flushqueue
       @destinations[dest]
     rescue => detail
       puts detail.backtrace if Puppet[:debug]
 
       # If this was our only destination, then add the console back in.
       newdestination(:console) if @destinations.empty? and (dest != :console and dest != "console")
     end
   end
 
   # Route the actual message. FIXME There are lots of things this method
   # should do, like caching and a bit more.  It's worth noting that there's
   # a potential for a loop here, if the machine somehow gets the destination set as
   # itself.
   def Log.newmessage(msg)
     return if @levels.index(msg.level) < @loglevel
 
     queuemessage(msg) if @destinations.length == 0
 
     @destinations.each do |name, dest|
       threadlock(dest) do
         dest.handle(msg)
       end
     end
   end
 
   def Log.queuemessage(msg)
     @queued.push(msg)
   end
 
   def Log.flushqueue
     return unless @destinations.size >= 1
     @queued.each do |msg|
       Log.newmessage(msg)
     end
     @queued.clear
   end
 
   def Log.sendlevel?(level)
     @levels.index(level) >= @loglevel
   end
 
   # Reopen all of our logs.
   def Log.reopen
     Puppet.notice "Reopening log files"
     types = @destinations.keys
     @destinations.each { |type, dest|
       dest.close if dest.respond_to?(:close)
     }
     @destinations.clear
     # We need to make sure we always end up with some kind of destination
     begin
       types.each { |type|
         Log.newdestination(type)
       }
     rescue => detail
       if @destinations.empty?
         Log.newdestination(:syslog)
         Puppet.err detail.to_s
       end
     end
   end
 
   # Is the passed level a valid log level?
   def self.validlevel?(level)
     @levels.include?(level)
   end
 
   attr_accessor :time, :remote, :file, :line, :source
   attr_reader :level, :message
 
   def initialize(args)
     self.level = args[:level]
     self.message = args[:message]
     self.source = args[:source] || "Puppet"
 
     @time = Time.now
 
     if tags = args[:tags]
       tags.each { |t| self.tag(t) }
     end
 
     [:file, :line].each do |attr|
       next unless value = args[attr]
       send(attr.to_s + "=", value)
     end
 
     Log.newmessage(self)
   end
 
   def message=(msg)
     raise ArgumentError, "Puppet::Util::Log requires a message" unless msg
     @message = msg.to_s
   end
 
   def level=(level)
     raise ArgumentError, "Puppet::Util::Log requires a log level" unless level
     @level = level.to_sym
     raise ArgumentError, "Invalid log level #{@level}" unless self.class.validlevel?(@level)
 
     # Tag myself with my log level
     tag(level)
   end
 
   # If they pass a source in to us, we make sure it is a string, and
   # we retrieve any tags we can.
   def source=(source)
     if source.respond_to?(:source_descriptors)
       descriptors = source.source_descriptors
       @source = descriptors[:path]
 
       descriptors[:tags].each { |t| tag(t) }
 
       [:file, :line].each do |param|
         next unless descriptors[param]
         send(param.to_s + "=", descriptors[param])
       end
     else
       @source = source.to_s
     end
   end
 
   def to_report
     "#{time} #{source} (#{level}): #{to_s}"
   end
 
   def to_s
     message
   end
 end
 
 # This is for backward compatibility from when we changed the constant to Puppet::Util::Log
 # because the reports include the constant name.  Apparently the alias was created in
 # March 2007, should could probably be removed soon.
 Puppet::Log = Puppet::Util::Log
diff --git a/lib/puppet/util/log/destinations.rb b/lib/puppet/util/log/destinations.rb
index 2e2f9a5b7..dd0d996bf 100644
--- a/lib/puppet/util/log/destinations.rb
+++ b/lib/puppet/util/log/destinations.rb
@@ -1,229 +1,231 @@
 Puppet::Util::Log.newdesttype :syslog do
   def close
     Syslog.close
   end
 
   def initialize
     Syslog.close if Syslog.opened?
     name = Puppet[:name]
     name = "puppet-#{name}" unless name =~ /puppet/
 
     options = Syslog::LOG_PID | Syslog::LOG_NDELAY
 
     # XXX This should really be configurable.
     str = Puppet[:syslogfacility]
     begin
       facility = Syslog.const_get("LOG_#{str.upcase}")
     rescue NameError
       raise Puppet::Error, "Invalid syslog facility #{str}"
     end
 
     @syslog = Syslog.open(name, options, facility)
   end
 
   def handle(msg)
     # XXX Syslog currently has a bug that makes it so you
     # cannot log a message with a '%' in it.  So, we get rid
     # of them.
     if msg.source == "Puppet"
       @syslog.send(msg.level, msg.to_s.gsub("%", '%%'))
     else
       @syslog.send(msg.level, "(%s) %s" % [msg.source.to_s.gsub("%", ""),
           msg.to_s.gsub("%", '%%')
         ]
       )
     end
   end
 end
 
 Puppet::Util::Log.newdesttype :file do
   match(/^\//)
 
   def close
     if defined?(@file)
       @file.close
       @file = nil
     end
   end
 
   def flush
     @file.flush if defined?(@file)
   end
 
+  attr_accessor :autoflush
+
   def initialize(path)
     @name = path
     # first make sure the directory exists
     # We can't just use 'Config.use' here, because they've
     # specified a "special" destination.
     unless FileTest.exist?(File.dirname(path))
       Puppet.recmkdir(File.dirname(path))
       Puppet.info "Creating log directory #{File.dirname(path)}"
     end
 
     # create the log file, if it doesn't already exist
     file = File.open(path, File::WRONLY|File::CREAT|File::APPEND)
 
     @file = file
 
     @autoflush = Puppet[:autoflush]
   end
 
   def handle(msg)
     @file.puts("#{msg.time} #{msg.source} (#{msg.level}): #{msg}")
 
     @file.flush if @autoflush
   end
 end
 
 Puppet::Util::Log.newdesttype :console do
 
 
   RED     = {:console => "", :html => "FFA0A0"}
   GREEN   = {:console => "", :html => "00CD00"}
   YELLOW  = {:console => "", :html => "FFFF60"}
   BLUE    = {:console => "", :html => "80A0FF"}
   PURPLE  = {:console => "", :html => "FFA500"}
   CYAN    = {:console => "", :html => "40FFFF"}
   WHITE   = {:console => "", :html => "FFFFFF"}
   HRED    = {:console => "", :html => "FFA0A0"}
   HGREEN  = {:console => "", :html => "00CD00"}
   HYELLOW = {:console => "", :html => "FFFF60"}
   HBLUE   = {:console => "", :html => "80A0FF"}
   HPURPLE = {:console => "", :html => "FFA500"}
   HCYAN   = {:console => "", :html => "40FFFF"}
   HWHITE  = {:console => "", :html => "FFFFFF"}
   RESET   = {:console => "",    :html => ""      }
 
   @@colormap = {
     :debug => WHITE,
     :info => GREEN,
     :notice => CYAN,
     :warning => YELLOW,
     :err => HPURPLE,
     :alert => RED,
     :emerg => HRED,
     :crit => HRED
   }
 
   def colorize(level, str)
     case Puppet[:color]
     when true, :ansi, "ansi", "yes"; console_color(level, str)
     when :html, "html"; html_color(level, str)
     else
       str
     end
   end
 
   def console_color(level, str)
     @@colormap[level][:console] + str + RESET[:console]
   end
 
   def html_color(level, str)
     %{<span style="color: %s">%s</span>} % [@@colormap[level][:html], str]
   end
 
   def initialize
     # Flush output immediately.
     $stdout.sync = true
   end
 
   def handle(msg)
     if msg.source == "Puppet"
       puts colorize(msg.level, "#{msg.level}: #{msg}")
     else
       puts colorize(msg.level, "#{msg.level}: #{msg.source}: #{msg}")
     end
   end
 end
 
 Puppet::Util::Log.newdesttype :host do
   def initialize(host)
     Puppet.info "Treating #{host} as a hostname"
     args = {}
     if host =~ /:(\d+)/
       args[:Port] = $1
       args[:Server] = host.sub(/:\d+/, '')
     else
       args[:Server] = host
     end
 
     @name = host
 
     @driver = Puppet::Network::Client::LogClient.new(args)
   end
 
   def handle(msg)
     unless msg.is_a?(String) or msg.remote
       @hostname ||= Facter["hostname"].value
       unless defined?(@domain)
         @domain = Facter["domain"].value
         @hostname += ".#{@domain}" if @domain
       end
       if msg.source =~ /^\//
         msg.source = @hostname + ":#{msg.source}"
       elsif msg.source == "Puppet"
         msg.source = @hostname + " #{msg.source}"
       else
         msg.source = @hostname + " #{msg.source}"
       end
       begin
         #puts "would have sent #{msg}"
         #puts "would have sent %s" %
         #    CGI.escape(YAML.dump(msg))
         begin
           tmp = CGI.escape(YAML.dump(msg))
         rescue => detail
           puts "Could not dump: #{detail}"
           return
         end
         # Add the hostname to the source
         @driver.addlog(tmp)
       rescue => detail
         puts detail.backtrace if Puppet[:trace]
         Puppet.err detail
         Puppet::Util::Log.close(self)
       end
     end
   end
 end
 
 # Log to a transaction report.
 Puppet::Util::Log.newdesttype :report do
   attr_reader :report
 
   match "Puppet::Transaction::Report"
 
   def initialize(report)
     @report = report
   end
 
   def handle(msg)
     @report << msg
   end
 end
 
 # Log to an array, just for testing.
 module Puppet::Test
   class LogCollector
     def initialize(logs)
       @logs = logs
     end
 
     def <<(value)
       @logs << value
     end
   end
 end
 
 Puppet::Util::Log.newdesttype :array do
   match "Puppet::Test::LogCollector"
 
   def initialize(messages)
     @messages = messages
   end
 
   def handle(msg)
     @messages << msg
   end
 end
 
diff --git a/spec/unit/application_spec.rb b/spec/unit/application_spec.rb
index 65f06169c..ca663e317 100755
--- a/spec/unit/application_spec.rb
+++ b/spec/unit/application_spec.rb
@@ -1,528 +1,569 @@
 #!/usr/bin/env ruby
 
 require File.expand_path(File.dirname(__FILE__) + '/../spec_helper')
 
 require 'puppet/application'
 require 'puppet'
 require 'getoptlong'
 
 describe Puppet::Application do
 
   before do
     @app = Class.new(Puppet::Application).new
     @appclass = @app.class
 
     # avoid actually trying to parse any settings
     Puppet.settings.stubs(:parse)
   end
 
   describe "finding" do
     before do
       @klass = Puppet::Application
       @klass.stubs(:puts)
     end
 
     it "should find classes in the namespace" do
       @klass.find("Agent").should == @klass::Agent
     end
 
     it "should not find classes outside the namespace" do
       lambda { @klass.find("String") }.should raise_error(SystemExit)
     end
 
     it "should exit if it can't find a class" do
       lambda { @klass.find("ThisShallNeverEverEverExistAsdf") }.should raise_error(SystemExit)
     end
   end
 
   describe ".run_mode" do
     it "should default to user" do
       @appclass.run_mode.name.should == :user
     end
 
     it "should set and get a value" do
       @appclass.run_mode :agent
       @appclass.run_mode.name.should == :agent
     end
   end
 
+  it "should sadly and frighteningly allow run_mode to change at runtime" do
+    class TestApp < Puppet::Application
+      run_mode :master
+      def run_command
+        # This is equivalent to calling these methods externally to the
+        # instance, but since this is what "real world" code is likely to do
+        # (and we need the class anyway) we may as well test that. --daniel 2011-02-03
+        set_run_mode self.class.run_mode "agent"
+      end
+    end
+
+    Puppet[:run_mode].should == "user"
+
+    expect {
+      app = TestApp.new
+
+      Puppet[:run_mode].should == "master"
+
+      app.run
+
+      app.class.run_mode.name.should == :agent
+      $puppet_application_mode.name.should == :agent
+    }.should_not raise_error
+
+    Puppet[:run_mode].should == "agent"
+  end
+
+  it "it should not allow run mode to be set multiple times" do
+    pending "great floods of tears, you can do this right now" # --daniel 2011-02-03
+    app = Puppet::Application.new
+    expect {
+      app.set_run_mode app.class.run_mode "master"
+      $puppet_application_mode.name.should == :master
+      app.set_run_mode app.class.run_mode "agent"
+      $puppet_application_mode.name.should == :agent
+    }.should raise_error
+  end
+
+  it "should explode when an invalid run mode is set at runtime, for great victory"
+  # ...but you can, and while it will explode, that only happens too late for
+  # us to easily test. --daniel 2011-02-03
+
   it "should have a run entry-point" do
     @app.should respond_to(:run)
   end
 
   it "should have a read accessor to options" do
     @app.should respond_to(:options)
   end
 
   it "should include a default setup method" do
     @app.should respond_to(:setup)
   end
 
   it "should include a default preinit method" do
     @app.should respond_to(:preinit)
   end
 
   it "should include a default run_command method" do
     @app.should respond_to(:run_command)
   end
 
   it "should invoke main as the default" do
     @app.expects( :main )
     @app.run_command
   end
 
   describe 'when invoking clear!' do
     before :each do
       Puppet::Application.run_status = :stop_requested
       Puppet::Application.clear!
     end
 
     it 'should have nil run_status' do
       Puppet::Application.run_status.should be_nil
     end
 
     it 'should return false for restart_requested?' do
       Puppet::Application.restart_requested?.should be_false
     end
 
     it 'should return false for stop_requested?' do
       Puppet::Application.stop_requested?.should be_false
     end
 
     it 'should return false for interrupted?' do
       Puppet::Application.interrupted?.should be_false
     end
 
     it 'should return true for clear?' do
       Puppet::Application.clear?.should be_true
     end
   end
 
   describe 'after invoking stop!' do
     before :each do
       Puppet::Application.run_status = nil
       Puppet::Application.stop!
     end
 
     after :each do
       Puppet::Application.run_status = nil
     end
 
     it 'should have run_status of :stop_requested' do
       Puppet::Application.run_status.should == :stop_requested
     end
 
     it 'should return true for stop_requested?' do
       Puppet::Application.stop_requested?.should be_true
     end
 
     it 'should return false for restart_requested?' do
       Puppet::Application.restart_requested?.should be_false
     end
 
     it 'should return true for interrupted?' do
       Puppet::Application.interrupted?.should be_true
     end
 
     it 'should return false for clear?' do
       Puppet::Application.clear?.should be_false
     end
   end
 
   describe 'when invoking restart!' do
     before :each do
       Puppet::Application.run_status = nil
       Puppet::Application.restart!
     end
 
     after :each do
       Puppet::Application.run_status = nil
     end
 
     it 'should have run_status of :restart_requested' do
       Puppet::Application.run_status.should == :restart_requested
     end
 
     it 'should return true for restart_requested?' do
       Puppet::Application.restart_requested?.should be_true
     end
 
     it 'should return false for stop_requested?' do
       Puppet::Application.stop_requested?.should be_false
     end
 
     it 'should return true for interrupted?' do
       Puppet::Application.interrupted?.should be_true
     end
 
     it 'should return false for clear?' do
       Puppet::Application.clear?.should be_false
     end
   end
 
   describe 'when performing a controlled_run' do
     it 'should not execute block if not :clear?' do
       Puppet::Application.run_status = :stop_requested
       target = mock 'target'
       target.expects(:some_method).never
       Puppet::Application.controlled_run do
         target.some_method
       end
     end
 
     it 'should execute block if :clear?' do
       Puppet::Application.run_status = nil
       target = mock 'target'
       target.expects(:some_method).once
       Puppet::Application.controlled_run do
         target.some_method
       end
     end
 
     describe 'on POSIX systems', :if => Puppet.features.posix? do
       it 'should signal process with HUP after block if restart requested during block execution' do
         Puppet::Application.run_status = nil
         target = mock 'target'
         target.expects(:some_method).once
         old_handler = trap('HUP') { target.some_method }
         begin
           Puppet::Application.controlled_run do
             Puppet::Application.run_status = :restart_requested
           end
         ensure
           trap('HUP', old_handler)
         end
       end
     end
 
     after :each do
       Puppet::Application.run_status = nil
     end
   end
 
   describe "when parsing command-line options" do
 
     before :each do
       @app.command_line.stubs(:args).returns([])
 
       Puppet.settings.stubs(:optparse_addargs).returns([])
     end
 
     it "should pass the banner to the option parser" do
       option_parser = stub "option parser"
       option_parser.stubs(:on)
       option_parser.stubs(:parse!)
       @app.class.instance_eval do
         banner "banner"
       end
 
       OptionParser.expects(:new).with("banner").returns(option_parser)
 
       @app.parse_options
     end
 
     it "should get options from Puppet.settings.optparse_addargs" do
       Puppet.settings.expects(:optparse_addargs).returns([])
 
       @app.parse_options
     end
 
     it "should add Puppet.settings options to OptionParser" do
       Puppet.settings.stubs(:optparse_addargs).returns( [["--option","-o", "Funny Option"]])
       Puppet.settings.expects(:handlearg).with("--option", 'true')
       @app.command_line.stubs(:args).returns(["--option"])
       @app.parse_options
     end
 
     it "should ask OptionParser to parse the command-line argument" do
       @app.command_line.stubs(:args).returns(%w{ fake args })
       OptionParser.any_instance.expects(:parse!).with(%w{ fake args })
 
       @app.parse_options
     end
 
-    describe "when using --help", :if => Puppet.features.usage? do
+    describe "when using --help" do
 
-      it "should call RDoc::usage and exit" do
+      it "should call exit" do
         @app.expects(:exit)
-        RDoc.expects(:usage).returns(true)
 
         @app.handle_help(nil)
       end
 
     end
 
     describe "when using --version" do
       it "should declare a version option" do
         @app.should respond_to(:handle_version)
       end
 
       it "should exit after printing the version" do
         @app.stubs(:puts)
 
         lambda { @app.handle_version(nil) }.should raise_error(SystemExit)
       end
     end
 
     describe "when dealing with an argument not declared directly by the application" do
       it "should pass it to handle_unknown if this method exists" do
         Puppet.settings.stubs(:optparse_addargs).returns([["--not-handled", :REQUIRED]])
 
         @app.expects(:handle_unknown).with("--not-handled", "value").returns(true)
         @app.command_line.stubs(:args).returns(["--not-handled", "value"])
         @app.parse_options
       end
 
       it "should pass it to Puppet.settings if handle_unknown says so" do
         Puppet.settings.stubs(:optparse_addargs).returns([["--topuppet", :REQUIRED]])
 
         @app.stubs(:handle_unknown).with("--topuppet", "value").returns(false)
 
         Puppet.settings.expects(:handlearg).with("--topuppet", "value")
         @app.command_line.stubs(:args).returns(["--topuppet", "value"])
         @app.parse_options
       end
 
       it "should pass it to Puppet.settings if there is no handle_unknown method" do
         Puppet.settings.stubs(:optparse_addargs).returns([["--topuppet", :REQUIRED]])
 
         @app.stubs(:respond_to?).returns(false)
 
         Puppet.settings.expects(:handlearg).with("--topuppet", "value")
         @app.command_line.stubs(:args).returns(["--topuppet", "value"])
         @app.parse_options
       end
 
       it "should transform boolean false value to string for Puppet.settings" do
         Puppet.settings.expects(:handlearg).with("--option", "false")
         @app.handlearg("--option", false)
       end
 
       it "should transform boolean true value to string for Puppet.settings" do
         Puppet.settings.expects(:handlearg).with("--option", "true")
         @app.handlearg("--option", true)
       end
 
       it "should transform boolean option to normal form for Puppet.settings" do
         Puppet.settings.expects(:handlearg).with("--option", "true")
         @app.handlearg("--[no-]option", true)
       end
 
       it "should transform boolean option to no- form for Puppet.settings" do
         Puppet.settings.expects(:handlearg).with("--no-option", "false")
         @app.handlearg("--[no-]option", false)
       end
 
     end
 
     it "should exit if OptionParser raises an error" do
       $stderr.stubs(:puts)
       OptionParser.any_instance.stubs(:parse!).raises(OptionParser::ParseError.new("blah blah"))
 
       @app.expects(:exit)
 
       lambda { @app.parse_options }.should_not raise_error
     end
 
   end
 
   describe "when calling default setup" do
 
     before :each do
       @app.stubs(:should_parse_config?).returns(false)
       @app.options.stubs(:[])
     end
 
     [ :debug, :verbose ].each do |level|
       it "should honor option #{level}" do
         @app.options.stubs(:[]).with(level).returns(true)
         Puppet::Util::Log.stubs(:newdestination)
 
         Puppet::Util::Log.expects(:level=).with(level == :verbose ? :info : :debug)
 
         @app.setup
       end
     end
 
     it "should honor setdest option" do
       @app.options.stubs(:[]).with(:setdest).returns(false)
 
       Puppet::Util::Log.expects(:newdestination).with(:syslog)
 
       @app.setup
     end
 
   end
 
   describe "when running" do
 
     before :each do
       @app.stubs(:preinit)
       @app.stubs(:setup)
       @app.stubs(:parse_options)
     end
 
     it "should call preinit" do
       @app.stubs(:run_command)
 
       @app.expects(:preinit)
 
       @app.run
     end
 
     it "should call parse_options" do
       @app.stubs(:run_command)
 
       @app.expects(:parse_options)
 
       @app.run
     end
 
     it "should call run_command" do
 
       @app.expects(:run_command)
 
       @app.run
     end
 
     it "should parse Puppet configuration if should_parse_config is called" do
       @app.stubs(:run_command)
       @app.class.should_parse_config
 
       Puppet.settings.expects(:parse)
 
       @app.run
     end
 
     it "should not parse_option if should_not_parse_config is called" do
       @app.stubs(:run_command)
       @app.class.should_not_parse_config
 
       Puppet.settings.expects(:parse).never
 
       @app.run
     end
 
     it "should parse Puppet configuration if needed" do
       @app.stubs(:run_command)
       @app.stubs(:should_parse_config?).returns(true)
 
       Puppet.settings.expects(:parse)
 
       @app.run
     end
 
     it "should call run_command" do
       @app.expects(:run_command)
 
       @app.run
     end
 
     it "should call main as the default command" do
       @app.expects(:main)
 
       @app.run
     end
 
     it "should warn and exit if no command can be called" do
       $stderr.expects(:puts)
       @app.expects(:exit).with(1)
       @app.run
     end
 
     it "should raise an error if dispatch returns no command" do
       @app.stubs(:get_command).returns(nil)
       $stderr.expects(:puts)
       @app.expects(:exit).with(1)
       @app.run
     end
 
     it "should raise an error if dispatch returns an invalid command" do
       @app.stubs(:get_command).returns(:this_function_doesnt_exist)
       $stderr.expects(:puts)
       @app.expects(:exit).with(1)
       @app.run
     end
   end
 
   describe "when metaprogramming" do
 
     describe "when calling option" do
       it "should create a new method named after the option" do
         @app.class.option("--test1","-t") do
         end
 
         @app.should respond_to(:handle_test1)
       end
 
       it "should transpose in option name any '-' into '_'" do
         @app.class.option("--test-dashes-again","-t") do
         end
 
         @app.should respond_to(:handle_test_dashes_again)
       end
 
       it "should create a new method called handle_test2 with option(\"--[no-]test2\")" do
         @app.class.option("--[no-]test2","-t") do
         end
 
         @app.should respond_to(:handle_test2)
       end
 
       describe "when a block is passed" do
         it "should create a new method with it" do
           @app.class.option("--[no-]test2","-t") do
             raise "I can't believe it, it works!"
           end
 
           lambda { @app.handle_test2 }.should raise_error
         end
 
         it "should declare the option to OptionParser" do
           OptionParser.any_instance.stubs(:on)
           OptionParser.any_instance.expects(:on).with { |*arg| arg[0] == "--[no-]test3" }
 
           @app.class.option("--[no-]test3","-t") do
           end
 
           @app.parse_options
         end
 
         it "should pass a block that calls our defined method" do
           OptionParser.any_instance.stubs(:on)
           OptionParser.any_instance.stubs(:on).with('--test4','-t').yields(nil)
 
           @app.expects(:send).with(:handle_test4, nil)
 
           @app.class.option("--test4","-t") do
           end
 
           @app.parse_options
         end
       end
 
       describe "when no block is given" do
         it "should declare the option to OptionParser" do
           OptionParser.any_instance.stubs(:on)
           OptionParser.any_instance.expects(:on).with("--test4","-t")
 
           @app.class.option("--test4","-t")
 
           @app.parse_options
         end
 
         it "should give to OptionParser a block that adds the the value to the options array" do
           OptionParser.any_instance.stubs(:on)
           OptionParser.any_instance.stubs(:on).with("--test4","-t").yields(nil)
 
           @app.options.expects(:[]=).with(:test4,nil)
 
           @app.class.option("--test4","-t")
 
           @app.parse_options
         end
       end
     end
 
   end
 end
diff --git a/spec/unit/util/log/destinations_spec.rb b/spec/unit/util/log/destinations_spec.rb
index 468702fb3..b84c2ab44 100755
--- a/spec/unit/util/log/destinations_spec.rb
+++ b/spec/unit/util/log/destinations_spec.rb
@@ -1,24 +1,37 @@
 #!/usr/bin/env ruby
 
 require File.expand_path(File.dirname(__FILE__) + '/../../../spec_helper')
 
 require 'puppet/util/log'
 
 describe Puppet::Util::Log.desttypes[:report] do
   before do
     @dest = Puppet::Util::Log.desttypes[:report]
   end
 
   it "should require a report at initialization" do
     @dest.new("foo").report.should == "foo"
   end
 
   it "should send new messages to the report" do
     report = mock 'report'
     dest = @dest.new(report)
 
     report.expects(:<<).with("my log")
 
     dest.handle "my log"
   end
 end
+
+
+describe Puppet::Util::Log.desttypes[:file] do
+  before do
+    File.stubs(:open)           # prevent actually creating the file
+    @class = Puppet::Util::Log.desttypes[:file]
+  end
+
+  it "should default to autoflush false" do
+    @class.new('/tmp/log').autoflush.should == false
+  end
+end
+
diff --git a/spec/unit/util/log_spec.rb b/spec/unit/util/log_spec.rb
index a6f11739b..29df0787a 100755
--- a/spec/unit/util/log_spec.rb
+++ b/spec/unit/util/log_spec.rb
@@ -1,222 +1,227 @@
 #!/usr/bin/env ruby
 
 Dir.chdir(File.dirname(__FILE__)) { (s = lambda { |f| File.exist?(f) ? require(f) : Dir.chdir("..") { s.call(f) } }).call("spec/spec_helper.rb") }
 
 require 'puppet/util/log'
 
 describe Puppet::Util::Log do
   it "should write a given message to the specified destination" do
     arraydest = []
     Puppet::Util::Log.newdestination(Puppet::Test::LogCollector.new(arraydest))
     Puppet::Util::Log.new(:level => :notice, :message => "foo")
     message = arraydest.last.message
     message.should == "foo"
   end
 
   describe Puppet::Util::Log::DestConsole do
     before do
       @console = Puppet::Util::Log::DestConsole.new
     end
 
     it "should colorize if Puppet[:color] is :ansi" do
       Puppet[:color] = :ansi
 
       @console.colorize(:alert, "abc").should == "\e[0;31mabc\e[0m"
     end
 
     it "should colorize if Puppet[:color] is 'yes'" do
       Puppet[:color] = "yes"
 
       @console.colorize(:alert, "abc").should == "\e[0;31mabc\e[0m"
     end
 
     it "should htmlize if Puppet[:color] is :html" do
       Puppet[:color] = :html
 
       @console.colorize(:alert, "abc").should == "<span style=\"color: FFA0A0\">abc</span>"
     end
 
     it "should do nothing if Puppet[:color] is false" do
       Puppet[:color] = false
 
       @console.colorize(:alert, "abc").should == "abc"
     end
 
     it "should do nothing if Puppet[:color] is invalid" do
       Puppet[:color] = "invalid option"
 
       @console.colorize(:alert, "abc").should == "abc"
     end
   end
 
   describe "instances" do
     before do
       Puppet::Util::Log.stubs(:newmessage)
     end
 
     [:level, :message, :time, :remote].each do |attr|
       it "should have a #{attr} attribute" do
         log = Puppet::Util::Log.new :level => :notice, :message => "A test message"
         log.should respond_to(attr)
         log.should respond_to(attr.to_s + "=")
       end
     end
 
     it "should fail if created without a level" do
       lambda { Puppet::Util::Log.new(:message => "A test message") }.should raise_error(ArgumentError)
     end
 
     it "should fail if created without a message" do
       lambda { Puppet::Util::Log.new(:level => :notice) }.should raise_error(ArgumentError)
     end
 
     it "should make available the level passed in at initialization" do
       Puppet::Util::Log.new(:level => :notice, :message => "A test message").level.should == :notice
     end
 
     it "should make available the message passed in at initialization" do
       Puppet::Util::Log.new(:level => :notice, :message => "A test message").message.should == "A test message"
     end
 
     # LAK:NOTE I don't know why this behavior is here, I'm just testing what's in the code,
     # at least at first.
     it "should always convert messages to strings" do
       Puppet::Util::Log.new(:level => :notice, :message => :foo).message.should == "foo"
     end
 
     it "should flush the log queue when the first destination is specified" do
       Puppet::Util::Log.close_all
       Puppet::Util::Log.expects(:flushqueue)
       Puppet::Util::Log.newdestination(:console)
     end
 
     it "should convert the level to a symbol if it's passed in as a string" do
       Puppet::Util::Log.new(:level => "notice", :message => :foo).level.should == :notice
     end
 
     it "should fail if the level is not a symbol or string" do
       lambda { Puppet::Util::Log.new(:level => 50, :message => :foo) }.should raise_error(ArgumentError)
     end
 
     it "should fail if the provided level is not valid" do
       Puppet::Util::Log.expects(:validlevel?).with(:notice).returns false
       lambda { Puppet::Util::Log.new(:level => :notice, :message => :foo) }.should raise_error(ArgumentError)
     end
 
     it "should set its time to the initialization time" do
       time = mock 'time'
       Time.expects(:now).returns time
       Puppet::Util::Log.new(:level => "notice", :message => :foo).time.should equal(time)
     end
 
     it "should make available any passed-in tags" do
       log = Puppet::Util::Log.new(:level => "notice", :message => :foo, :tags => %w{foo bar})
       log.tags.should be_include("foo")
       log.tags.should be_include("bar")
     end
 
     it "should use an passed-in source" do
       Puppet::Util::Log.any_instance.expects(:source=).with "foo"
       Puppet::Util::Log.new(:level => "notice", :message => :foo, :source => "foo")
     end
 
     [:file, :line].each do |attr|
       it "should use #{attr} if provided" do
         Puppet::Util::Log.any_instance.expects(attr.to_s + "=").with "foo"
         Puppet::Util::Log.new(:level => "notice", :message => :foo, attr => "foo")
       end
     end
 
     it "should default to 'Puppet' as its source" do
       Puppet::Util::Log.new(:level => "notice", :message => :foo).source.should == "Puppet"
     end
 
     it "should register itself with Log" do
       Puppet::Util::Log.expects(:newmessage)
       Puppet::Util::Log.new(:level => "notice", :message => :foo)
     end
 
+    it "should update Log autoflush when Puppet[:autoflush] is set" do
+      Puppet::Util::Log.expects(:autoflush=).once.with(true)
+      Puppet[:autoflush] = true
+    end
+
     it "should have a method for determining if a tag is present" do
       Puppet::Util::Log.new(:level => "notice", :message => :foo).should respond_to(:tagged?)
     end
 
     it "should match a tag if any of the tags are equivalent to the passed tag as a string" do
       Puppet::Util::Log.new(:level => "notice", :message => :foo, :tags => %w{one two}).should be_tagged(:one)
     end
 
     it "should tag itself with its log level" do
       Puppet::Util::Log.new(:level => "notice", :message => :foo).should be_tagged(:notice)
     end
 
     it "should return its message when converted to a string" do
       Puppet::Util::Log.new(:level => "notice", :message => :foo).to_s.should == "foo"
     end
 
     it "should include its time, source, level, and message when prepared for reporting" do
       log = Puppet::Util::Log.new(:level => "notice", :message => :foo)
       report = log.to_report
       report.should be_include("notice")
       report.should be_include("foo")
       report.should be_include(log.source)
       report.should be_include(log.time.to_s)
     end
 
     describe "when setting the source as a RAL object" do
       it "should tag itself with any tags the source has" do
         source = Puppet::Type.type(:file).new :path => "/foo/bar"
         log = Puppet::Util::Log.new(:level => "notice", :message => :foo, :source => source)
         source.tags.each do |tag|
           log.tags.should be_include(tag)
         end
       end
 
       it "should use the source_descriptors" do
         source = stub "source"
         source.stubs(:source_descriptors).returns(:tags => ["tag","tag2"], :path => "path", :version => 100)
 
         log = Puppet::Util::Log.new(:level => "notice", :message => :foo)
         log.expects(:tag).with("tag")
         log.expects(:tag).with("tag2")
 
         log.source = source
 
         log.source.should == "path"
       end
 
       it "should copy over any file and line information" do
         source = Puppet::Type.type(:file).new :path => "/foo/bar"
         source.file = "/my/file"
         source.line = 50
         log = Puppet::Util::Log.new(:level => "notice", :message => :foo, :source => source)
         log.file.should == "/my/file"
         log.line.should == 50
       end
     end
 
     describe "when setting the source as a non-RAL object" do
       it "should not try to copy over file, version, line, or tag information" do
         source = Puppet::Module.new("foo")
         source.expects(:file).never
         log = Puppet::Util::Log.new(:level => "notice", :message => :foo, :source => source)
       end
     end
   end
 
   describe "to_yaml" do
     it "should not include the @version attribute" do
       log = Puppet::Util::Log.new(:level => "notice", :message => :foo, :version => 100)
       log.to_yaml_properties.should_not include('@version')
     end
 
     it "should include attributes @level, @message, @source, @tags, and @time" do
       log = Puppet::Util::Log.new(:level => "notice", :message => :foo, :version => 100)
       log.to_yaml_properties.should == %w{@level @message @source @tags @time}
     end
 
     it "should include attributes @file and @line if specified" do
       log = Puppet::Util::Log.new(:level => "notice", :message => :foo, :file => "foo", :line => 35)
       log.to_yaml_properties.should include('@file')
       log.to_yaml_properties.should include('@line')
     end
   end
 end