Merge branch 'main' into find2fdfind2fd

1 files changed, 963 insertions, 1195 deletions

diff --git a/src/parse.c b/src/parse.c
index fc30cd2..a1155c0 100644
--- a/src/parse.c
+++ b/src/parse.c
@@ -1,18 +1,5 @@
-/****************************************************************************
- * bfs                                                                      *
- * Copyright (C) 2015-2022 Tavian Barnes <tavianator@tavianator.com>        *
- *                                                                          *
- * Permission to use, copy, modify, and/or distribute this software for any *
- * purpose with or without fee is hereby granted.                           *
- *                                                                          *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES *
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF         *
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR  *
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES   *
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN    *
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF  *
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.           *
- ****************************************************************************/
+// Copyright © Tavian Barnes <tavianator@tavianator.com>
+// SPDX-License-Identifier: 0BSD
 
 /**
  * The command line parser.  Expressions are parsed by recursive descent, with a
@@ -21,28 +8,29 @@
  * flags like always-true options, and skipping over paths wherever they appear.
  */
 
+#include "prelude.h"
 #include "parse.h"
+#include "alloc.h"
 #include "bfstd.h"
 #include "bftw.h"
 #include "color.h"
-#include "config.h"
 #include "ctx.h"
-#include "darray.h"
 #include "diag.h"
 #include "dir.h"
 #include "eval.h"
 #include "exec.h"
 #include "expr.h"
 #include "fsade.h"
+#include "list.h"
 #include "opt.h"
 #include "printf.h"
 #include "pwcache.h"
+#include "sanity.h"
 #include "stat.h"
 #include "typo.h"
 #include "xregex.h"
 #include "xspawn.h"
 #include "xtime.h"
-#include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <fnmatch.h>
@@ -50,183 +38,21 @@
 #include <limits.h>
 #include <pwd.h>
 #include <stdarg.h>
-#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/time.h>
 #include <sys/stat.h>
-#include <sys/wait.h>
+#include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
 
 // Strings printed by -D tree for "fake" expressions
-static char *fake_and_arg = "-a";
-static char *fake_false_arg = "-false";
+static char *fake_and_arg = "-and";
 static char *fake_hidden_arg = "-hidden";
-static char *fake_or_arg = "-o";
+static char *fake_or_arg = "-or";
 static char *fake_print_arg = "-print";
 static char *fake_true_arg = "-true";
 
-// Cost estimation constants
-#define FAST_COST     40.0
-#define STAT_COST   1000.0
-#define PRINT_COST 20000.0
-
-struct bfs_expr bfs_true = {
-	.eval_fn = eval_true,
-	.argc = 1,
-	.argv = &fake_true_arg,
-	.pure = true,
-	.always_true = true,
-	.synthetic = true,
-	.cost = FAST_COST,
-	.probability = 1.0,
-};
-
-struct bfs_expr bfs_false = {
-	.eval_fn = eval_false,
-	.argc = 1,
-	.argv = &fake_false_arg,
-	.pure = true,
-	.always_false = true,
-	.synthetic = true,
-	.cost = FAST_COST,
-	.probability = 0.0,
-};
-
-void bfs_expr_free(struct bfs_expr *expr) {
-	if (!expr || expr == &bfs_true || expr == &bfs_false) {
-		return;
-	}
-
-	if (bfs_expr_has_children(expr)) {
-		bfs_expr_free(expr->rhs);
-		bfs_expr_free(expr->lhs);
-	} else if (expr->eval_fn == eval_exec) {
-		bfs_exec_free(expr->exec);
-	} else if (expr->eval_fn == eval_fprintf) {
-		bfs_printf_free(expr->printf);
-	} else if (expr->eval_fn == eval_regex) {
-		bfs_regfree(expr->regex);
-	}
-
-	free(expr);
-}
-
-struct bfs_expr *bfs_expr_new(bfs_eval_fn *eval_fn, size_t argc, char **argv) {
-	struct bfs_expr *expr = malloc(sizeof(*expr));
-	if (!expr) {
-		perror("malloc()");
-		return NULL;
-	}
-
-	expr->eval_fn = eval_fn;
-	expr->argc = argc;
-	expr->argv = argv;
-	expr->persistent_fds = 0;
-	expr->ephemeral_fds = 0;
-	expr->pure = false;
-	expr->always_true = false;
-	expr->always_false = false;
-	expr->synthetic = false;
-	expr->cost = FAST_COST;
-	expr->probability = 0.5;
-	expr->evaluations = 0;
-	expr->successes = 0;
-	expr->elapsed.tv_sec = 0;
-	expr->elapsed.tv_nsec = 0;
-
-	// Prevent bfs_expr_free() from freeing uninitialized pointers on error paths
-	if (bfs_expr_has_children(expr)) {
-		expr->lhs = NULL;
-		expr->rhs = NULL;
-	} else if (eval_fn == eval_exec) {
-		expr->exec = NULL;
-	} else if (eval_fn == eval_fprintf) {
-		expr->printf = NULL;
-	} else if (eval_fn == eval_regex) {
-		expr->regex = NULL;
-	}
-
-	return expr;
-}
-
-/**
- * Create a new unary expression.
- */
-static struct bfs_expr *new_unary_expr(bfs_eval_fn *eval_fn, struct bfs_expr *rhs, char **argv) {
-	struct bfs_expr *expr = bfs_expr_new(eval_fn, 1, argv);
-	if (!expr) {
-		bfs_expr_free(rhs);
-		return NULL;
-	}
-
-	expr->lhs = NULL;
-	expr->rhs = rhs;
-	assert(bfs_expr_has_children(expr));
-
-	expr->persistent_fds = rhs->persistent_fds;
-	expr->ephemeral_fds = rhs->ephemeral_fds;
-	return expr;
-}
-
-/**
- * Create a new binary expression.
- */
-static struct bfs_expr *new_binary_expr(bfs_eval_fn *eval_fn, struct bfs_expr *lhs, struct bfs_expr *rhs, char **argv) {
-	struct bfs_expr *expr = bfs_expr_new(eval_fn, 1, argv);
-	if (!expr) {
-		bfs_expr_free(rhs);
-		bfs_expr_free(lhs);
-		return NULL;
-	}
-
-	expr->lhs = lhs;
-	expr->rhs = rhs;
-	assert(bfs_expr_has_children(expr));
-
-	if (argv == &fake_and_arg || argv == &fake_or_arg) {
-		expr->synthetic = true;
-	}
-
-	expr->persistent_fds = lhs->persistent_fds + rhs->persistent_fds;
-	if (lhs->ephemeral_fds > rhs->ephemeral_fds) {
-		expr->ephemeral_fds = lhs->ephemeral_fds;
-	} else {
-		expr->ephemeral_fds = rhs->ephemeral_fds;
-	}
-
-	return expr;
-}
-
-bool bfs_expr_has_children(const struct bfs_expr *expr) {
-	return expr->eval_fn == eval_and
-		|| expr->eval_fn == eval_or
-		|| expr->eval_fn == eval_not
-		|| expr->eval_fn == eval_comma;
-}
-
-bool bfs_expr_never_returns(const struct bfs_expr *expr) {
-	// Expressions that never return are vacuously both always true and always false
-	return expr->always_true && expr->always_false;
-}
-
-/**
- * Set an expression to always return true.
- */
-static void expr_set_always_true(struct bfs_expr *expr) {
-	expr->always_true = true;
-	expr->probability = 1.0;
-}
-
-/**
- * Set an expression to never return.
- */
-static void expr_set_never_returns(struct bfs_expr *expr) {
-	expr->always_true = expr->always_false = true;
-}
-
 /**
  * Color use flags.
  */
@@ -237,9 +63,9 @@ enum use_color {
 };
 
 /**
- * Ephemeral state for parsing the command line.
+ * Command line parser state.
  */
-struct parser_state {
+struct bfs_parser {
 	/** The command line being constructed. */
 	struct bfs_ctx *ctx;
 	/** The command line arguments being parsed. */
@@ -271,20 +97,20 @@ struct parser_state {
 	char **last_arg;
 	/** A "-depth"-type argument, if any. */
 	char **depth_arg;
+	/** A "-limit" argument, if any. */
+	char **limit_arg;
 	/** A "-prune" argument, if any. */
 	char **prune_arg;
 	/** A "-mount" argument, if any. */
 	char **mount_arg;
 	/** An "-xdev" argument, if any. */
 	char **xdev_arg;
-	/** A "-files0-from" argument, if any. */
-	char **files0_arg;
 	/** A "-files0-from -" argument, if any. */
 	char **files0_stdin_arg;
 	/** An "-ok"-type expression, if any. */
 	const struct bfs_expr *ok_expr;
 
-	/** The current time. */
+	/** The current time (maybe modified by -daystart). */
 	struct timespec now;
 };
 
@@ -309,8 +135,8 @@ enum token_type {
 /**
  * Print a low-level error message during parsing.
  */
-static void parse_perror(const struct parser_state *state, const char *str) {
-	bfs_perror(state->ctx, str);
+static void parse_perror(const struct bfs_parser *parser, const char *str) {
+	bfs_perror(parser->ctx, str);
 }
 
 /** Initialize an empty highlighted range. */
@@ -324,7 +150,7 @@ static void init_highlight(const struct bfs_ctx *ctx, bool *args) {
 static void highlight_args(const struct bfs_ctx *ctx, char **argv, size_t argc, bool *args) {
 	size_t i = argv - ctx->argv;
 	for (size_t j = 0; j < argc; ++j) {
-		assert(i + j < ctx->argc);
+		bfs_assert(i + j < ctx->argc);
 		args[i + j] = true;
 	}
 }
@@ -332,30 +158,30 @@ static void highlight_args(const struct bfs_ctx *ctx, char **argv, size_t argc,
 /**
  * Print an error message during parsing.
  */
-BFS_FORMATTER(2, 3)
-static void parse_error(const struct parser_state *state, const char *format, ...) {
+attr(printf(2, 3))
+static void parse_error(const struct bfs_parser *parser, const char *format, ...) {
 	int error = errno;
-	const struct bfs_ctx *ctx = state->ctx;
+	const struct bfs_ctx *ctx = parser->ctx;
 
 	bool highlight[ctx->argc];
 	init_highlight(ctx, highlight);
-	highlight_args(ctx, state->argv, 1, highlight);
+	highlight_args(ctx, parser->argv, 1, highlight);
 	bfs_argv_error(ctx, highlight);
 
 	va_list args;
 	va_start(args, format);
 	errno = error;
-	bfs_verror(state->ctx, format, args);
+	bfs_verror(parser->ctx, format, args);
 	va_end(args);
 }
 
 /**
  * Print an error about some command line arguments.
  */
-BFS_FORMATTER(4, 5)
-static void parse_argv_error(const struct parser_state *state, char **argv, size_t argc, const char *format, ...) {
+attr(printf(4, 5))
+static void parse_argv_error(const struct bfs_parser *parser, char **argv, size_t argc, const char *format, ...) {
 	int error = errno;
-	const struct bfs_ctx *ctx = state->ctx;
+	const struct bfs_ctx *ctx = parser->ctx;
 
 	bool highlight[ctx->argc];
 	init_highlight(ctx, highlight);
@@ -372,10 +198,10 @@ static void parse_argv_error(const struct parser_state *state, char **argv, size
 /**
  * Print an error about conflicting command line arguments.
  */
-BFS_FORMATTER(6, 7)
-static void parse_conflict_error(const struct parser_state *state, char **argv1, size_t argc1, char **argv2, size_t argc2, const char *format, ...) {
+attr(printf(6, 7))
+static void parse_conflict_error(const struct bfs_parser *parser, char **argv1, size_t argc1, char **argv2, size_t argc2, const char *format, ...) {
 	int error = errno;
-	const struct bfs_ctx *ctx = state->ctx;
+	const struct bfs_ctx *ctx = parser->ctx;
 
 	bool highlight[ctx->argc];
 	init_highlight(ctx, highlight);
@@ -393,10 +219,10 @@ static void parse_conflict_error(const struct parser_state *state, char **argv1,
 /**
  * Print an error about an expression.
  */
-BFS_FORMATTER(3, 4)
-static void parse_expr_error(const struct parser_state *state, const struct bfs_expr *expr, const char *format, ...) {
+attr(printf(3, 4))
+static void parse_expr_error(const struct bfs_parser *parser, const struct bfs_expr *expr, const char *format, ...) {
 	int error = errno;
-	const struct bfs_ctx *ctx = state->ctx;
+	const struct bfs_ctx *ctx = parser->ctx;
 
 	bfs_expr_error(ctx, expr);
 
@@ -410,14 +236,14 @@ static void parse_expr_error(const struct parser_state *state, const struct bfs_
 /**
  * Print a warning message during parsing.
  */
-BFS_FORMATTER(2, 3)
-static bool parse_warning(const struct parser_state *state, const char *format, ...) {
+attr(printf(2, 3))
+static bool parse_warning(const struct bfs_parser *parser, const char *format, ...) {
 	int error = errno;
-	const struct bfs_ctx *ctx = state->ctx;
+	const struct bfs_ctx *ctx = parser->ctx;
 
 	bool highlight[ctx->argc];
 	init_highlight(ctx, highlight);
-	highlight_args(ctx, state->argv, 1, highlight);
+	highlight_args(ctx, parser->argv, 1, highlight);
 	if (!bfs_argv_warning(ctx, highlight)) {
 		return false;
 	}
@@ -425,7 +251,7 @@ static bool parse_warning(const struct parser_state *state, const char *format,
 	va_list args;
 	va_start(args, format);
 	errno = error;
-	bool ret = bfs_vwarning(state->ctx, format, args);
+	bool ret = bfs_vwarning(parser->ctx, format, args);
 	va_end(args);
 	return ret;
 }
@@ -433,10 +259,10 @@ static bool parse_warning(const struct parser_state *state, const char *format,
 /**
  * Print a warning about conflicting command line arguments.
  */
-BFS_FORMATTER(6, 7)
-static bool parse_conflict_warning(const struct parser_state *state, char **argv1, size_t argc1, char **argv2, size_t argc2, const char *format, ...) {
+attr(printf(6, 7))
+static bool parse_conflict_warning(const struct bfs_parser *parser, char **argv1, size_t argc1, char **argv2, size_t argc2, const char *format, ...) {
 	int error = errno;
-	const struct bfs_ctx *ctx = state->ctx;
+	const struct bfs_ctx *ctx = parser->ctx;
 
 	bool highlight[ctx->argc];
 	init_highlight(ctx, highlight);
@@ -457,10 +283,10 @@ static bool parse_conflict_warning(const struct parser_state *state, char **argv
 /**
  * Print a warning about an expression.
  */
-BFS_FORMATTER(3, 4)
-static bool parse_expr_warning(const struct parser_state *state, const struct bfs_expr *expr, const char *format, ...) {
+attr(printf(3, 4))
+static bool parse_expr_warning(const struct bfs_parser *parser, const struct bfs_expr *expr, const char *format, ...) {
 	int error = errno;
-	const struct bfs_ctx *ctx = state->ctx;
+	const struct bfs_ctx *ctx = parser->ctx;
 
 	if (!bfs_expr_warning(ctx, expr)) {
 		return false;
@@ -475,20 +301,58 @@ static bool parse_expr_warning(const struct parser_state *state, const struct bf
 }
 
 /**
+ * Allocate a new expression.
+ */
+static struct bfs_expr *parse_new_expr(const struct bfs_parser *parser, bfs_eval_fn *eval_fn, size_t argc, char **argv) {
+	struct bfs_expr *expr = bfs_expr_new(parser->ctx, eval_fn, argc, argv);
+	if (!expr) {
+		parse_perror(parser, "bfs_expr_new()");
+	}
+	return expr;
+}
+
+/**
+ * Create a new unary expression.
+ */
+static struct bfs_expr *new_unary_expr(const struct bfs_parser *parser, bfs_eval_fn *eval_fn, struct bfs_expr *rhs, char **argv) {
+	struct bfs_expr *expr = parse_new_expr(parser, eval_fn, 1, argv);
+	if (!expr) {
+		return NULL;
+	}
+
+	bfs_assert(bfs_expr_is_parent(expr));
+	bfs_expr_append(expr, rhs);
+	return expr;
+}
+
+/**
+ * Create a new binary expression.
+ */
+static struct bfs_expr *new_binary_expr(const struct bfs_parser *parser, bfs_eval_fn *eval_fn, struct bfs_expr *lhs, struct bfs_expr *rhs, char **argv) {
+	struct bfs_expr *expr = parse_new_expr(parser, eval_fn, 1, argv);
+	if (!expr) {
+		return NULL;
+	}
+
+	bfs_assert(bfs_expr_is_parent(expr));
+	bfs_expr_append(expr, lhs);
+	bfs_expr_append(expr, rhs);
+	return expr;
+}
+
+/**
  * Fill in a "-print"-type expression.
  */
-static void init_print_expr(struct parser_state *state, struct bfs_expr *expr) {
-	expr_set_always_true(expr);
-	expr->cost = PRINT_COST;
-	expr->cfile = state->ctx->cout;
+static void init_print_expr(struct bfs_parser *parser, struct bfs_expr *expr) {
+	expr->cfile = parser->ctx->cout;
 	expr->path = NULL;
 }
 
 /**
  * Open a file for an expression.
  */
-static int expr_open(struct parser_state *state, struct bfs_expr *expr, const char *path) {
-	struct bfs_ctx *ctx = state->ctx;
+static int expr_open(struct bfs_parser *parser, struct bfs_expr *expr, const char *path) {
+	struct bfs_ctx *ctx = parser->ctx;
 
 	FILE *file = NULL;
 	CFILE *cfile = NULL;
@@ -498,7 +362,7 @@ static int expr_open(struct parser_state *state, struct bfs_expr *expr, const ch
 		goto fail;
 	}
 
-	cfile = cfwrap(file, state->use_color ? ctx->colors : NULL, true);
+	cfile = cfwrap(file, parser->use_color ? ctx->colors : NULL, true);
 	if (!cfile) {
 		goto fail;
 	}
@@ -517,7 +381,7 @@ static int expr_open(struct parser_state *state, struct bfs_expr *expr, const ch
 	return 0;
 
 fail:
-	parse_expr_error(state, expr, "%m.\n");
+	parse_expr_error(parser, expr, "%m.\n");
 	if (cfile) {
 		cfclose(cfile);
 	} else if (file) {
@@ -529,15 +393,15 @@ fail:
 /**
  * Invoke bfs_stat() on an argument.
  */
-static int stat_arg(const struct parser_state *state, char **arg, struct bfs_stat *sb) {
-	const struct bfs_ctx *ctx = state->ctx;
+static int stat_arg(const struct bfs_parser *parser, char **arg, struct bfs_stat *sb) {
+	const struct bfs_ctx *ctx = parser->ctx;
 
 	bool follow = ctx->flags & (BFTW_FOLLOW_ROOTS | BFTW_FOLLOW_ALL);
 	enum bfs_stat_flags flags = follow ? BFS_STAT_TRYFOLLOW : BFS_STAT_NOFOLLOW;
 
 	int ret = bfs_stat(AT_FDCWD, *arg, flags, sb);
 	if (ret != 0) {
-		parse_argv_error(state, arg, 1, "%m.\n");
+		parse_argv_error(parser, arg, 1, "%m.\n");
 	}
 	return ret;
 }
@@ -545,52 +409,53 @@ static int stat_arg(const struct parser_state *state, char **arg, struct bfs_sta
 /**
  * Parse the expression specified on the command line.
  */
-static struct bfs_expr *parse_expr(struct parser_state *state);
+static struct bfs_expr *parse_expr(struct bfs_parser *parser);
 
 /**
  * Advance by a single token.
  */
-static char **parser_advance(struct parser_state *state, enum token_type type, size_t argc) {
+static char **parser_advance(struct bfs_parser *parser, enum token_type type, size_t argc) {
 	if (type != T_FLAG && type != T_PATH) {
-		state->expr_started = true;
+		parser->expr_started = true;
 	}
 
 	if (type != T_PATH) {
-		state->last_arg = state->argv;
+		parser->last_arg = parser->argv;
 	}
 
-	char **argv = state->argv;
-	state->argv += argc;
+	char **argv = parser->argv;
+	parser->argv += argc;
 	return argv;
 }
 
 /**
  * Parse a root path.
  */
-static int parse_root(struct parser_state *state, const char *path) {
-	char *copy = strdup(path);
-	if (!copy) {
-		parse_perror(state, "strdup()");
+static int parse_root(struct bfs_parser *parser, const char *path) {
+	struct bfs_ctx *ctx = parser->ctx;
+	const char **root = RESERVE(const char *, &ctx->paths, &ctx->npaths);
+	if (!root) {
+		parse_perror(parser, "RESERVE()");
 		return -1;
 	}
 
-	struct bfs_ctx *ctx = state->ctx;
-	if (DARRAY_PUSH(&ctx->paths, &copy) != 0) {
-		parse_perror(state, "DARRAY_PUSH()");
-		free(copy);
+	*root = strdup(path);
+	if (!*root) {
+		--ctx->npaths;
+		parse_perror(parser, "strdup()");
 		return -1;
 	}
 
-	state->implicit_root = false;
+	parser->implicit_root = false;
 	return 0;
 }
 
 /**
  * While parsing an expression, skip any paths and add them to ctx->paths.
  */
-static int skip_paths(struct parser_state *state) {
+static int skip_paths(struct bfs_parser *parser) {
 	while (true) {
-		const char *arg = state->argv[0];
+		const char *arg = parser->argv[0];
 		if (!arg) {
 			return 0;
 		}
@@ -600,7 +465,7 @@ static int skip_paths(struct parser_state *state) {
 				// find uses -- to separate flags from the rest
 				// of the command line.  We allow mixing flags
 				// and paths/predicates, so we just ignore --.
-				parser_advance(state, T_FLAG, 1);
+				parser_advance(parser, T_FLAG, 1);
 				continue;
 			}
 			if (strcmp(arg, "-") != 0) {
@@ -615,7 +480,7 @@ static int skip_paths(struct parser_state *state) {
 			return 0;
 		}
 
-		if (state->expr_started) {
+		if (parser->expr_started) {
 			// By POSIX, these can be paths.  We only treat them as
 			// such at the beginning of the command line.
 			if (strcmp(arg, ")") == 0 || strcmp(arg, ",") == 0) {
@@ -623,16 +488,16 @@ static int skip_paths(struct parser_state *state) {
 			}
 		}
 
-		if (state->excluding) {
-			parse_warning(state, "This path will not be excluded.  Use a test like ${blu}-name${rs} or ${blu}-path${rs}\n");
-			bfs_warning(state->ctx, "within ${red}-exclude${rs} to exclude matching files.\n\n");
+		if (parser->excluding) {
+			parse_warning(parser, "This path will not be excluded.  Use a test like ${blu}-name${rs} or ${blu}-path${rs}\n");
+			bfs_warning(parser->ctx, "within ${red}-exclude${rs} to exclude matching files.\n\n");
 		}
 
-		if (parse_root(state, arg) != 0) {
+		if (parse_root(parser, arg) != 0) {
 			return -1;
 		}
 
-		parser_advance(state, T_PATH, 1);
+		parser_advance(parser, T_PATH, 1);
 	}
 }
 
@@ -651,14 +516,18 @@ enum int_flags {
 /**
  * Parse an integer.
  */
-static const char *parse_int(const struct parser_state *state, char **arg, const char *str, void *result, enum int_flags flags) {
-	char *endptr;
+static const char *parse_int(const struct bfs_parser *parser, char **arg, const char *str, void *result, enum int_flags flags) {
+	// strtoll() skips leading spaces, but we want to reject them
+	if (xisspace(str[0])) {
+		goto bad;
+	}
 
 	int base = flags & IF_BASE_MASK;
 	if (base == 0) {
 		base = 10;
 	}
 
+	char *endptr;
 	errno = 0;
 	long long value = strtoll(str, &endptr, base);
 	if (errno != 0) {
@@ -669,6 +538,9 @@ static const char *parse_int(const struct parser_state *state, char **arg, const
 		}
 	}
 
+	// https://github.com/llvm/llvm-project/issues/64946
+	sanitize_init(&endptr);
+
 	if (endptr == str) {
 		goto bad;
 	}
@@ -701,7 +573,7 @@ static const char *parse_int(const struct parser_state *state, char **arg, const
 		break;
 
 	default:
-		assert(!"Invalid int size");
+		bfs_bug("Invalid int size");
 		goto bad;
 	}
 
@@ -709,19 +581,19 @@ static const char *parse_int(const struct parser_state *state, char **arg, const
 
 bad:
 	if (!(flags & IF_QUIET)) {
-		parse_argv_error(state, arg, 1, "${bld}%s${rs} is not a valid integer.\n", str);
+		parse_argv_error(parser, arg, 1, "${bld}%pq${rs} is not a valid integer.\n", str);
 	}
 	return NULL;
 
 negative:
 	if (!(flags & IF_QUIET)) {
-		parse_argv_error(state, arg, 1, "Negative integer ${bld}%s${rs} is not allowed here.\n", str);
+		parse_argv_error(parser, arg, 1, "Negative integer ${bld}%pq${rs} is not allowed here.\n", str);
 	}
 	return NULL;
 
 range:
 	if (!(flags & IF_QUIET)) {
-		parse_argv_error(state, arg, 1, "${bld}%s${rs} is too large an integer.\n", str);
+		parse_argv_error(parser, arg, 1, "${bld}%pq${rs} is too large an integer.\n", str);
 	}
 	return NULL;
 }
@@ -729,7 +601,7 @@ range:
 /**
  * Parse an integer and a comparison flag.
  */
-static const char *parse_icmp(const struct parser_state *state, struct bfs_expr *expr, enum int_flags flags) {
+static const char *parse_icmp(const struct bfs_parser *parser, struct bfs_expr *expr, enum int_flags flags) {
 	char **arg = &expr->argv[1];
 	const char *str = *arg;
 	switch (str[0]) {
@@ -746,7 +618,7 @@ static const char *parse_icmp(const struct parser_state *state, struct bfs_expr
 		break;
 	}
 
-	return parse_int(state, arg, str, &expr->num, flags | IF_LONG_LONG | IF_UNSIGNED);
+	return parse_int(parser, arg, str, &expr->num, flags | IF_LONG_LONG | IF_UNSIGNED);
 }
 
 /**
@@ -768,136 +640,139 @@ static bool looks_like_icmp(const char *str) {
 /**
  * Parse a single flag.
  */
-static struct bfs_expr *parse_flag(struct parser_state *state, size_t argc) {
-	parser_advance(state, T_FLAG, argc);
-	return &bfs_true;
+static struct bfs_expr *parse_flag(struct bfs_parser *parser, size_t argc) {
+	char **argv = parser_advance(parser, T_FLAG, argc);
+	return parse_new_expr(parser, eval_true, argc, argv);
 }
 
 /**
  * Parse a flag that doesn't take a value.
  */
-static struct bfs_expr *parse_nullary_flag(struct parser_state *state) {
-	return parse_flag(state, 1);
+static struct bfs_expr *parse_nullary_flag(struct bfs_parser *parser) {
+	return parse_flag(parser, 1);
+}
+
+/**
+ * Parse a flag that takes a value.
+ */
+static struct bfs_expr *parse_unary_flag(struct bfs_parser *parser) {
+	const char *arg = parser->argv[0];
+	const char *value = parser->argv[1];
+	if (!value) {
+		parse_error(parser, "${cyn}%s${rs} needs a value.\n", arg);
+		return NULL;
+	}
+
+	return parse_flag(parser, 2);
 }
 
 /**
  * Parse a single option.
  */
-static struct bfs_expr *parse_option(struct parser_state *state, size_t argc) {
-	parser_advance(state, T_OPTION, argc);
-	return &bfs_true;
+static struct bfs_expr *parse_option(struct bfs_parser *parser, size_t argc) {
+	char **argv = parser_advance(parser, T_OPTION, argc);
+	return parse_new_expr(parser, eval_true, argc, argv);
 }
 
 /**
  * Parse an option that doesn't take a value.
  */
-static struct bfs_expr *parse_nullary_option(struct parser_state *state) {
-	return parse_option(state, 1);
+static struct bfs_expr *parse_nullary_option(struct bfs_parser *parser) {
+	return parse_option(parser, 1);
 }
 
 /**
  * Parse an option that takes a value.
  */
-static struct bfs_expr *parse_unary_option(struct parser_state *state) {
-	return parse_option(state, 2);
+static struct bfs_expr *parse_unary_option(struct bfs_parser *parser) {
+	const char *arg = parser->argv[0];
+	const char *value = parser->argv[1];
+	if (!value) {
+		parse_error(parser, "${blu}%s${rs} needs a value.\n", arg);
+		return NULL;
+	}
+
+	return parse_option(parser, 2);
 }
 
 /**
  * Parse a single test.
  */
-static struct bfs_expr *parse_test(struct parser_state *state, bfs_eval_fn *eval_fn, size_t argc) {
-	char **argv = parser_advance(state, T_TEST, argc);
-	struct bfs_expr *expr = bfs_expr_new(eval_fn, argc, argv);
-	if (expr) {
-		expr->pure = true;
-	}
-	return expr;
+static struct bfs_expr *parse_test(struct bfs_parser *parser, bfs_eval_fn *eval_fn, size_t argc) {
+	char **argv = parser_advance(parser, T_TEST, argc);
+	return parse_new_expr(parser, eval_fn, argc, argv);
 }
 
 /**
  * Parse a test that doesn't take a value.
  */
-static struct bfs_expr *parse_nullary_test(struct parser_state *state, bfs_eval_fn *eval_fn) {
-	return parse_test(state, eval_fn, 1);
+static struct bfs_expr *parse_nullary_test(struct bfs_parser *parser, bfs_eval_fn *eval_fn) {
+	return parse_test(parser, eval_fn, 1);
 }
 
 /**
  * Parse a test that takes a value.
  */
-static struct bfs_expr *parse_unary_test(struct parser_state *state, bfs_eval_fn *eval_fn) {
-	const char *arg = state->argv[0];
-	const char *value = state->argv[1];
+static struct bfs_expr *parse_unary_test(struct bfs_parser *parser, bfs_eval_fn *eval_fn) {
+	const char *arg = parser->argv[0];
+	const char *value = parser->argv[1];
 	if (!value) {
-		parse_error(state, "${blu}%s${rs} needs a value.\n", arg);
+		parse_error(parser, "${blu}%s${rs} needs a value.\n", arg);
 		return NULL;
 	}
 
-	return parse_test(state, eval_fn, 2);
+	return parse_test(parser, eval_fn, 2);
 }
 
 /**
  * Parse a single action.
  */
-static struct bfs_expr *parse_action(struct parser_state *state, bfs_eval_fn *eval_fn, size_t argc) {
-	char **argv = parser_advance(state, T_ACTION, argc);
+static struct bfs_expr *parse_action(struct bfs_parser *parser, bfs_eval_fn *eval_fn, size_t argc) {
+	char **argv = parser_advance(parser, T_ACTION, argc);
 
-	if (state->excluding) {
-		parse_argv_error(state, argv, argc, "This action is not supported within ${red}-exclude${rs}.\n");
+	if (parser->excluding) {
+		parse_argv_error(parser, argv, argc, "This action is not supported within ${red}-exclude${rs}.\n");
 		return NULL;
 	}
 
-	if (eval_fn != eval_prune && eval_fn != eval_quit) {
-		state->implicit_print = false;
+	if (eval_fn != eval_limit && eval_fn != eval_prune && eval_fn != eval_quit) {
+		parser->implicit_print = false;
 	}
 
-	return bfs_expr_new(eval_fn, argc, argv);
+	return parse_new_expr(parser, eval_fn, argc, argv);
 }
 
 /**
  * Parse an action that takes no arguments.
  */
-static struct bfs_expr *parse_nullary_action(struct parser_state *state, bfs_eval_fn *eval_fn) {
-	return parse_action(state, eval_fn, 1);
+static struct bfs_expr *parse_nullary_action(struct bfs_parser *parser, bfs_eval_fn *eval_fn) {
+	return parse_action(parser, eval_fn, 1);
 }
 
 /**
  * Parse an action that takes one argument.
  */
-static struct bfs_expr *parse_unary_action(struct parser_state *state, bfs_eval_fn *eval_fn) {
-	const char *arg = state->argv[0];
-	const char *value = state->argv[1];
+static struct bfs_expr *parse_unary_action(struct bfs_parser *parser, bfs_eval_fn *eval_fn) {
+	const char *arg = parser->argv[0];
+	const char *value = parser->argv[1];
 	if (!value) {
-		parse_error(state, "${blu}%s${rs} needs a value.\n", arg);
+		parse_error(parser, "${blu}%s${rs} needs a value.\n", arg);
 		return NULL;
 	}
 
-	return parse_action(state, eval_fn, 2);
-}
-
-/**
- * Add an expression to the exclusions.
- */
-static int parse_exclude(struct parser_state *state, struct bfs_expr *expr) {
-	struct bfs_ctx *ctx = state->ctx;
-	ctx->exclude = new_binary_expr(eval_or, ctx->exclude, expr, &fake_or_arg);
-	if (ctx->exclude) {
-		return 0;
-	} else {
-		return -1;
-	}
+	return parse_action(parser, eval_fn, 2);
 }
 
 /**
  * Parse a test expression with integer data and a comparison flag.
  */
-static struct bfs_expr *parse_test_icmp(struct parser_state *state, bfs_eval_fn *eval_fn) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_fn);
+static struct bfs_expr *parse_test_icmp(struct bfs_parser *parser, bfs_eval_fn *eval_fn) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_fn);
 	if (!expr) {
 		return NULL;
 	}
 
-	if (!parse_icmp(state, expr, 0)) {
-		bfs_expr_free(expr);
+	if (!parse_icmp(parser, expr, 0)) {
 		return NULL;
 	}
 
@@ -933,22 +808,19 @@ static bool parse_debug_flag(const char *flag, size_t len, const char *expected)
 /**
  * Parse -D FLAG.
  */
-static struct bfs_expr *parse_debug(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_ctx *ctx = state->ctx;
+static struct bfs_expr *parse_debug(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_ctx *ctx = parser->ctx;
 
-	const char *arg = state->argv[0];
-	const char *flags = state->argv[1];
-	if (!flags) {
-		parse_error(state, "${cyn}%s${rs} needs a flag.\n\n", arg);
+	struct bfs_expr *expr = parse_unary_flag(parser);
+	if (!expr) {
+		cfprintf(ctx->cerr, "\n");
 		debug_help(ctx->cerr);
 		return NULL;
 	}
 
-	parser_advance(state, T_FLAG, 1);
-
 	bool unrecognized = false;
 
-	for (const char *flag = flags, *next; flag; flag = next) {
+	for (const char *flag = expr->argv[1], *next; flag; flag = next) {
 		size_t len = strcspn(flag, ",");
 		if (flag[len]) {
 			next = flag + len + 1;
@@ -958,7 +830,7 @@ static struct bfs_expr *parse_debug(struct parser_state *state, int arg1, int ar
 
 		if (parse_debug_flag(flag, len, "help")) {
 			debug_help(ctx->cout);
-			state->just_info = true;
+			parser->just_info = true;
 			return NULL;
 		} else if (parse_debug_flag(flag, len, "all")) {
 			ctx->debug = DEBUG_ALL;
@@ -976,7 +848,7 @@ static struct bfs_expr *parse_debug(struct parser_state *state, int arg1, int ar
 		if (DEBUG_ALL & i) {
 			ctx->debug |= i;
 		} else {
-			if (parse_warning(state, "Unrecognized debug flag ${bld}")) {
+			if (parse_expr_warning(parser, expr, "Unrecognized debug flag ${bld}")) {
 				fwrite(flag, 1, len, stderr);
 				cfprintf(ctx->cerr, "${rs}.\n\n");
 				unrecognized = true;
@@ -989,91 +861,74 @@ static struct bfs_expr *parse_debug(struct parser_state *state, int arg1, int ar
 		cfprintf(ctx->cerr, "\n");
 	}
 
-	parser_advance(state, T_FLAG, 1);
-	return &bfs_true;
+	return expr;
 }
 
 /**
  * Parse -On.
  */
-static struct bfs_expr *parse_optlevel(struct parser_state *state, int arg1, int arg2) {
-	int *optlevel = &state->ctx->optlevel;
+static struct bfs_expr *parse_optlevel(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_flag(parser);
+	if (!expr) {
+		return NULL;
+	}
 
-	if (strcmp(state->argv[0], "-Ofast") == 0) {
+	int *optlevel = &parser->ctx->optlevel;
+
+	if (strcmp(expr->argv[0], "-Ofast") == 0) {
 		*optlevel = 4;
-	} else if (!parse_int(state, state->argv, state->argv[0] + 2, optlevel, IF_INT | IF_UNSIGNED)) {
+	} else if (!parse_int(parser, expr->argv, expr->argv[0] + 2, optlevel, IF_INT | IF_UNSIGNED)) {
 		return NULL;
 	}
 
 	if (*optlevel > 4) {
-		parse_warning(state, "${cyn}-O${bld}%s${rs} is the same as ${cyn}-O${bld}4${rs}.\n\n", state->argv[0] + 2);
+		parse_expr_warning(parser, expr, "${cyn}-O${bld}%s${rs} is the same as ${cyn}-O${bld}4${rs}.\n\n", expr->argv[0] + 2);
 	}
 
-	return parse_nullary_flag(state);
+	return expr;
 }
 
 /**
  * Parse -[PHL], -follow.
  */
-static struct bfs_expr *parse_follow(struct parser_state *state, int flags, int option) {
-	struct bfs_ctx *ctx = state->ctx;
+static struct bfs_expr *parse_follow(struct bfs_parser *parser, int flags, int option) {
+	struct bfs_ctx *ctx = parser->ctx;
 	ctx->flags &= ~(BFTW_FOLLOW_ROOTS | BFTW_FOLLOW_ALL);
 	ctx->flags |= flags;
 	if (option) {
-		return parse_nullary_option(state);
+		return parse_nullary_option(parser);
 	} else {
-		return parse_nullary_flag(state);
+		return parse_nullary_flag(parser);
 	}
 }
 
 /**
  * Parse -X.
  */
-static struct bfs_expr *parse_xargs_safe(struct parser_state *state, int arg1, int arg2) {
-	state->ctx->xargs_safe = true;
-	return parse_nullary_flag(state);
+static struct bfs_expr *parse_xargs_safe(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->ctx->xargs_safe = true;
+	return parse_nullary_flag(parser);
 }
 
 /**
  * Parse -executable, -readable, -writable
  */
-static struct bfs_expr *parse_access(struct parser_state *state, int flag, int arg2) {
-	struct bfs_expr *expr = parse_nullary_test(state, eval_access);
-	if (!expr) {
-		return NULL;
-	}
-
-	expr->num = flag;
-	expr->cost = STAT_COST;
-
-	switch (flag) {
-	case R_OK:
-		expr->probability = 0.99;
-		break;
-	case W_OK:
-		expr->probability = 0.8;
-		break;
-	case X_OK:
-		expr->probability = 0.2;
-		break;
+static struct bfs_expr *parse_access(struct bfs_parser *parser, int flag, int arg2) {
+	struct bfs_expr *expr = parse_nullary_test(parser, eval_access);
+	if (expr) {
+		expr->num = flag;
 	}
-
 	return expr;
 }
 
 /**
  * Parse -acl.
  */
-static struct bfs_expr *parse_acl(struct parser_state *state, int flag, int arg2) {
+static struct bfs_expr *parse_acl(struct bfs_parser *parser, int flag, int arg2) {
 #if BFS_CAN_CHECK_ACL
-	struct bfs_expr *expr = parse_nullary_test(state, eval_acl);
-	if (expr) {
-		expr->cost = STAT_COST;
-		expr->probability = 0.00002;
-	}
-	return expr;
+	return parse_nullary_test(parser, eval_acl);
 #else
-	parse_error(state, "Missing platform support.\n");
+	parse_error(parser, "Missing platform support.\n");
 	return NULL;
 #endif
 }
@@ -1081,38 +936,32 @@ static struct bfs_expr *parse_acl(struct parser_state *state, int flag, int arg2
 /**
  * Parse -[aBcm]?newer.
  */
-static struct bfs_expr *parse_newer(struct parser_state *state, int field, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_newer);
+static struct bfs_expr *parse_newer(struct bfs_parser *parser, int field, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_newer);
 	if (!expr) {
 		return NULL;
 	}
 
 	struct bfs_stat sb;
-	if (stat_arg(state, &expr->argv[1], &sb) != 0) {
-		goto fail;
+	if (stat_arg(parser, &expr->argv[1], &sb) != 0) {
+		return NULL;
 	}
 
-	expr->cost = STAT_COST;
 	expr->reftime = sb.mtime;
 	expr->stat_field = field;
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -[aBcm]min.
  */
-static struct bfs_expr *parse_min(struct parser_state *state, int field, int arg2) {
-	struct bfs_expr *expr = parse_test_icmp(state, eval_time);
+static struct bfs_expr *parse_min(struct bfs_parser *parser, int field, int arg2) {
+	struct bfs_expr *expr = parse_test_icmp(parser, eval_time);
 	if (!expr) {
 		return NULL;
 	}
 
-	expr->cost = STAT_COST;
-	expr->reftime = state->now;
+	expr->reftime = parser->now;
 	expr->stat_field = field;
 	expr->time_unit = BFS_MINUTES;
 	return expr;
@@ -1121,19 +970,18 @@ static struct bfs_expr *parse_min(struct parser_state *state, int field, int arg
 /**
  * Parse -[aBcm]time.
  */
-static struct bfs_expr *parse_time(struct parser_state *state, int field, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_time);
+static struct bfs_expr *parse_time(struct bfs_parser *parser, int field, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_time);
 	if (!expr) {
 		return NULL;
 	}
 
-	expr->cost = STAT_COST;
-	expr->reftime = state->now;
+	expr->reftime = parser->now;
 	expr->stat_field = field;
 
-	const char *tail = parse_icmp(state, expr, IF_PARTIAL_OK);
+	const char *tail = parse_icmp(parser, expr, IF_PARTIAL_OK);
 	if (!tail) {
-		goto fail;
+		return NULL;
 	}
 
 	if (!*tail) {
@@ -1148,21 +996,21 @@ static struct bfs_expr *parse_time(struct parser_state *state, int field, int ar
 		switch (*tail) {
 		case 'w':
 			time *= 7;
-			BFS_FALLTHROUGH;
+			fallthru;
 		case 'd':
 			time *= 24;
-			BFS_FALLTHROUGH;
+			fallthru;
 		case 'h':
 			time *= 60;
-			BFS_FALLTHROUGH;
+			fallthru;
 		case 'm':
 			time *= 60;
-			BFS_FALLTHROUGH;
+			fallthru;
 		case 's':
 			break;
 		default:
-			parse_expr_error(state, expr, "Unknown time unit ${bld}%c${rs}.\n", *tail);
-			goto fail;
+			parse_expr_error(parser, expr, "Unknown time unit ${bld}%c${rs}.\n", *tail);
+			return NULL;
 		}
 
 		expr->num += time;
@@ -1171,37 +1019,28 @@ static struct bfs_expr *parse_time(struct parser_state *state, int field, int ar
 			break;
 		}
 
-		tail = parse_int(state, &expr->argv[1], tail, &time, IF_PARTIAL_OK | IF_LONG_LONG | IF_UNSIGNED);
+		tail = parse_int(parser, &expr->argv[1], tail, &time, IF_PARTIAL_OK | IF_LONG_LONG | IF_UNSIGNED);
 		if (!tail) {
-			goto fail;
+			return NULL;
 		}
 		if (!*tail) {
-			parse_expr_error(state, expr, "Missing time unit.\n");
-			goto fail;
+			parse_expr_error(parser, expr, "Missing time unit.\n");
+			return NULL;
 		}
 	}
 
 	expr->time_unit = BFS_SECONDS;
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -capable.
  */
-static struct bfs_expr *parse_capable(struct parser_state *state, int flag, int arg2) {
+static struct bfs_expr *parse_capable(struct bfs_parser *parser, int flag, int arg2) {
 #if BFS_CAN_CHECK_CAPABILITIES
-	struct bfs_expr *expr = parse_nullary_test(state, eval_capable);
-	if (expr) {
-		expr->cost = STAT_COST;
-		expr->probability = 0.000002;
-	}
-	return expr;
+	return parse_nullary_test(parser, eval_capable);
 #else
-	parse_error(state, "Missing platform support.\n");
+	parse_error(parser, "Missing platform support.\n");
 	return NULL;
 #endif
 }
@@ -1209,47 +1048,112 @@ static struct bfs_expr *parse_capable(struct parser_state *state, int flag, int
 /**
  * Parse -(no)?color.
  */
-static struct bfs_expr *parse_color(struct parser_state *state, int color, int arg2) {
-	struct bfs_ctx *ctx = state->ctx;
+static struct bfs_expr *parse_color(struct bfs_parser *parser, int color, int arg2) {
+	struct bfs_expr *expr = parse_nullary_option(parser);
+	if (!expr) {
+		return NULL;
+	}
+
+	struct bfs_ctx *ctx = parser->ctx;
 	struct colors *colors = ctx->colors;
 
 	if (color) {
 		if (!colors) {
-			parse_error(state, "%s.\n", strerror(ctx->colors_error));
+			parse_expr_error(parser, expr, "Error parsing $$LS_COLORS: %s.\n", xstrerror(ctx->colors_error));
 			return NULL;
 		}
 
-		state->use_color = COLOR_ALWAYS;
+		parser->use_color = COLOR_ALWAYS;
 		ctx->cout->colors = colors;
 		ctx->cerr->colors = colors;
 	} else {
-		state->use_color = COLOR_NEVER;
+		parser->use_color = COLOR_NEVER;
 		ctx->cout->colors = NULL;
 		ctx->cerr->colors = NULL;
 	}
 
-	return parse_nullary_option(state);
+	return expr;
+}
+
+/**
+ * Common code for fnmatch() tests.
+ */
+static struct bfs_expr *parse_fnmatch(const struct bfs_parser *parser, struct bfs_expr *expr, bool casefold) {
+	if (!expr) {
+		return NULL;
+	}
+
+	expr->pattern = expr->argv[1];
+
+	if (casefold) {
+#ifdef FNM_CASEFOLD
+		expr->fnm_flags = FNM_CASEFOLD;
+#else
+		parse_expr_error(parser, expr, "Missing platform support.\n");
+		return NULL;
+#endif
+	} else {
+		expr->fnm_flags = 0;
+	}
+
+	// POSIX says, about fnmatch():
+	//
+	//     If pattern ends with an unescaped <backslash>, fnmatch() shall
+	//     return a non-zero value (indicating either no match or an error).
+	//
+	// But not all implementations obey this, so check for it ourselves.
+	size_t i, len = strlen(expr->pattern);
+	for (i = 0; i < len; ++i) {
+		if (expr->pattern[len - i - 1] != '\\') {
+			break;
+		}
+	}
+	if (i % 2 != 0) {
+		parse_expr_warning(parser, expr, "Unescaped trailing backslash.\n\n");
+		expr->eval_fn = eval_false;
+		return expr;
+	}
+
+	// strcmp() can be much faster than fnmatch() since it doesn't have to
+	// parse the pattern, so special-case patterns with no wildcards.
+	//
+	//     https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_13_01
+	expr->literal = strcspn(expr->pattern, "?*\\[") == len;
+
+	return expr;
+}
+
+/**
+ * Parse -context.
+ */
+static struct bfs_expr *parse_context(struct bfs_parser *parser, int flag, int arg2) {
+#if BFS_CAN_CHECK_CONTEXT
+	struct bfs_expr *expr = parse_unary_test(parser, eval_context);
+	return parse_fnmatch(parser, expr, false);
+#else
+	parse_error(parser, "Missing platform support.\n");
+	return NULL;
+#endif
 }
 
 /**
  * Parse -{false,true}.
  */
-static struct bfs_expr *parse_const(struct parser_state *state, int value, int arg2) {
-	parser_advance(state, T_TEST, 1);
-	return value ? &bfs_true : &bfs_false;
+static struct bfs_expr *parse_const(struct bfs_parser *parser, int value, int arg2) {
+	return parse_nullary_test(parser, value ? eval_true : eval_false);
 }
 
 /**
  * Parse -daystart.
  */
-static struct bfs_expr *parse_daystart(struct parser_state *state, int arg1, int arg2) {
+static struct bfs_expr *parse_daystart(struct bfs_parser *parser, int arg1, int arg2) {
 	struct tm tm;
-	if (xlocaltime(&state->now.tv_sec, &tm) != 0) {
-		parse_perror(state, "xlocaltime()");
+	if (!localtime_r(&parser->now.tv_sec, &tm)) {
+		parse_perror(parser, "localtime_r()");
 		return NULL;
 	}
 
-	if (tm.tm_hour || tm.tm_min || tm.tm_sec || state->now.tv_nsec) {
+	if (tm.tm_hour || tm.tm_min || tm.tm_sec || parser->now.tv_nsec) {
 		++tm.tm_mday;
 	}
 	tm.tm_hour = 0;
@@ -1258,100 +1162,87 @@ static struct bfs_expr *parse_daystart(struct parser_state *state, int arg1, int
 
 	time_t time;
 	if (xmktime(&tm, &time) != 0) {
-		parse_perror(state, "xmktime()");
+		parse_perror(parser, "xmktime()");
 		return NULL;
 	}
 
-	state->now.tv_sec = time;
-	state->now.tv_nsec = 0;
+	parser->now.tv_sec = time;
+	parser->now.tv_nsec = 0;
 
-	return parse_nullary_option(state);
+	return parse_nullary_option(parser);
 }
 
 /**
  * Parse -delete.
  */
-static struct bfs_expr *parse_delete(struct parser_state *state, int arg1, int arg2) {
-	state->ctx->flags |= BFTW_POST_ORDER;
-	state->depth_arg = state->argv;
-	return parse_nullary_action(state, eval_delete);
+static struct bfs_expr *parse_delete(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->ctx->flags |= BFTW_POST_ORDER;
+	parser->depth_arg = parser->argv;
+	return parse_nullary_action(parser, eval_delete);
 }
 
 /**
  * Parse -d.
  */
-static struct bfs_expr *parse_depth(struct parser_state *state, int arg1, int arg2) {
-	state->ctx->flags |= BFTW_POST_ORDER;
-	state->depth_arg = state->argv;
-	return parse_nullary_flag(state);
+static struct bfs_expr *parse_depth(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->ctx->flags |= BFTW_POST_ORDER;
+	parser->depth_arg = parser->argv;
+	return parse_nullary_flag(parser);
 }
 
 /**
  * Parse -depth [N].
  */
-static struct bfs_expr *parse_depth_n(struct parser_state *state, int arg1, int arg2) {
-	const char *arg = state->argv[1];
+static struct bfs_expr *parse_depth_n(struct bfs_parser *parser, int arg1, int arg2) {
+	const char *arg = parser->argv[1];
 	if (arg && looks_like_icmp(arg)) {
-		return parse_test_icmp(state, eval_depth);
+		return parse_test_icmp(parser, eval_depth);
 	} else {
-		return parse_depth(state, arg1, arg2);
+		return parse_depth(parser, arg1, arg2);
 	}
 }
 
 /**
  * Parse -{min,max}depth N.
  */
-static struct bfs_expr *parse_depth_limit(struct parser_state *state, int is_min, int arg2) {
-	struct bfs_ctx *ctx = state->ctx;
-	const char *arg = state->argv[0];
-	const char *value = state->argv[1];
-	if (!value) {
-		parse_error(state, "${blu}%s${rs} needs a value.\n", arg);
+static struct bfs_expr *parse_depth_limit(struct bfs_parser *parser, int is_min, int arg2) {
+	struct bfs_expr *expr = parse_unary_option(parser);
+	if (!expr) {
 		return NULL;
 	}
 
+	struct bfs_ctx *ctx = parser->ctx;
 	int *depth = is_min ? &ctx->mindepth : &ctx->maxdepth;
-	if (!parse_int(state, &state->argv[1], value, depth, IF_INT | IF_UNSIGNED)) {
+	char **arg = &expr->argv[1];
+	if (!parse_int(parser, arg, *arg, depth, IF_INT | IF_UNSIGNED)) {
 		return NULL;
 	}
 
-	return parse_unary_option(state);
+	return expr;
 }
 
 /**
  * Parse -empty.
  */
-static struct bfs_expr *parse_empty(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_test(state, eval_empty);
-	if (!expr) {
-		return NULL;
-	}
-
-	expr->cost = 2000.0;
-	expr->probability = 0.01;
-
-	if (state->ctx->optlevel < 4) {
-		// Since -empty attempts to open and read directories, it may
-		// have side effects such as reporting permission errors, and
-		// thus shouldn't be re-ordered without aggressive optimizations
-		expr->pure = false;
+static struct bfs_expr *parse_empty(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_test(parser, eval_empty);
+	if (expr) {
+		// For opendir()
+		expr->ephemeral_fds = 1;
 	}
-
-	expr->ephemeral_fds = 1;
-
 	return expr;
 }
 
 /**
  * Parse -exec(dir)?/-ok(dir)?.
  */
-static struct bfs_expr *parse_exec(struct parser_state *state, int flags, int arg2) {
-	struct bfs_exec *execbuf = bfs_exec_parse(state->ctx, state->argv, flags);
+static struct bfs_expr *parse_exec(struct bfs_parser *parser, int flags, int arg2) {
+	struct bfs_exec *execbuf = bfs_exec_parse(parser->ctx, parser->argv, flags);
 	if (!execbuf) {
 		return NULL;
 	}
 
-	struct bfs_expr *expr = parse_action(state, eval_exec, execbuf->tmpl_argc + 2);
+	struct bfs_expr *expr = parse_action(parser, eval_exec, execbuf->tmpl_argc + 2);
 	if (!expr) {
 		bfs_exec_free(execbuf);
 		return NULL;
@@ -1359,23 +1250,42 @@ static struct bfs_expr *parse_exec(struct parser_state *state, int flags, int ar
 
 	expr->exec = execbuf;
 
-	if (execbuf->flags & BFS_EXEC_MULTI) {
-		expr_set_always_true(expr);
-	} else {
-		expr->cost = 1000000.0;
-	}
-
+	// For pipe() in bfs_spawn()
 	expr->ephemeral_fds = 2;
+
 	if (execbuf->flags & BFS_EXEC_CHDIR) {
+		// Check for relative paths in $PATH
+		const char *path = getenv("PATH");
+		while (path) {
+			if (*path != '/') {
+				size_t len = strcspn(path, ":");
+				char *comp = strndup(path, len);
+				if (comp) {
+					parse_expr_error(parser, expr,
+						"This action would be unsafe, since ${bld}$$PATH${rs} contains the relative path ${bld}%pq${rs}\n", comp);
+					free(comp);
+				} else {
+					parse_perror(parser, "strndup()");
+				}
+				return NULL;
+			}
+
+			path = strchr(path, ':');
+			if (path) {
+				++path;
+			}
+		}
+
+		// To dup() the parent directory
 		if (execbuf->flags & BFS_EXEC_MULTI) {
-			expr->persistent_fds = 1;
+			++expr->persistent_fds;
 		} else {
 			++expr->ephemeral_fds;
 		}
 	}
 
 	if (execbuf->flags & BFS_EXEC_CONFIRM) {
-		state->ok_expr = expr;
+		parser->ok_expr = expr;
 	}
 
 	return expr;
@@ -1384,18 +1294,17 @@ static struct bfs_expr *parse_exec(struct parser_state *state, int flags, int ar
 /**
  * Parse -exit [STATUS].
  */
-static struct bfs_expr *parse_exit(struct parser_state *state, int arg1, int arg2) {
+static struct bfs_expr *parse_exit(struct bfs_parser *parser, int arg1, int arg2) {
 	size_t argc = 1;
-	const char *value = state->argv[1];
+	const char *value = parser->argv[1];
 
 	int status = EXIT_SUCCESS;
-	if (value && parse_int(state, NULL, value, &status, IF_INT | IF_UNSIGNED | IF_QUIET)) {
+	if (value && parse_int(parser, NULL, value, &status, IF_INT | IF_UNSIGNED | IF_QUIET)) {
 		argc = 2;
 	}
 
-	struct bfs_expr *expr = parse_action(state, eval_exit, argc);
+	struct bfs_expr *expr = parse_action(parser, eval_exit, argc);
 	if (expr) {
-		expr_set_never_returns(expr);
 		expr->num = status;
 	}
 	return expr;
@@ -1404,34 +1313,29 @@ static struct bfs_expr *parse_exit(struct parser_state *state, int arg1, int arg
 /**
  * Parse -f PATH.
  */
-static struct bfs_expr *parse_f(struct parser_state *state, int arg1, int arg2) {
-	const char *path = state->argv[1];
-	if (!path) {
-		parse_error(state, "${cyn}-f${rs} requires a path.\n");
+static struct bfs_expr *parse_f(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_flag(parser);
+	if (!expr) {
 		return NULL;
 	}
 
-	if (parse_root(state, path) != 0) {
+	if (parse_root(parser, expr->argv[1]) != 0) {
 		return NULL;
 	}
 
-	parser_advance(state, T_FLAG, 1);
-	parser_advance(state, T_PATH, 1);
-	return &bfs_true;
+	return expr;
 }
 
 /**
  * Parse -files0-from PATH.
  */
-static struct bfs_expr *parse_files0_from(struct parser_state *state, int arg1, int arg2) {
-	const char *arg = state->argv[0];
-	const char *from = state->argv[1];
-	if (!from) {
-		parse_error(state, "${blu}%s${rs} requires a path.\n", arg);
+static struct bfs_expr *parse_files0_from(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_option(parser);
+	if (!expr) {
 		return NULL;
 	}
 
-	state->files0_arg = parser_advance(state, T_OPTION, 1);
+	const char *from = expr->argv[1];
 
 	FILE *file;
 	if (strcmp(from, "-") == 0) {
@@ -1440,46 +1344,48 @@ static struct bfs_expr *parse_files0_from(struct parser_state *state, int arg1,
 		file = xfopen(from, O_RDONLY | O_CLOEXEC);
 	}
 	if (!file) {
-		parse_error(state, "%m.\n");
+		parse_expr_error(parser, expr, "%m.\n");
 		return NULL;
 	}
 
-	struct bfs_expr *expr = &bfs_true;
-
 	while (true) {
 		char *path = xgetdelim(file, '\0');
 		if (!path) {
 			if (errno) {
-				parse_error(state, "%m.\n");
-				expr = NULL;
+				goto fail;
+			} else {
+				break;
 			}
-			break;
 		}
 
-		int ret = parse_root(state, path);
+		int ret = parse_root(parser, path);
 		free(path);
 		if (ret != 0) {
-			expr = NULL;
-			break;
+			goto fail;
 		}
 	}
 
 	if (file == stdin) {
-		state->files0_stdin_arg = state->files0_arg;
+		parser->files0_stdin_arg = expr->argv;
 	} else {
 		fclose(file);
 	}
 
-	state->implicit_root = false;
-	parser_advance(state, T_OPTION, 1);
+	parser->implicit_root = false;
 	return expr;
+
+fail:
+	if (file != stdin) {
+		fclose(file);
+	}
+	return NULL;
 }
 
 /**
  * Parse -flags FLAGS.
  */
-static struct bfs_expr *parse_flags(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_flags);
+static struct bfs_expr *parse_flags(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_flags);
 	if (!expr) {
 		return NULL;
 	}
@@ -1501,11 +1407,10 @@ static struct bfs_expr *parse_flags(struct parser_state *state, int arg1, int ar
 
 	if (xstrtofflags(&flags, &expr->set_flags, &expr->clear_flags) != 0) {
 		if (errno == ENOTSUP) {
-			parse_expr_error(state, expr, "Missing platform support.\n");
+			parse_expr_error(parser, expr, "Missing platform support.\n");
 		} else {
-			parse_expr_error(state, expr, "Invalid flags.\n");
+			parse_expr_error(parser, expr, "Invalid flags.\n");
 		}
-		bfs_expr_free(expr);
 		return NULL;
 	}
 
@@ -1515,351 +1420,300 @@ static struct bfs_expr *parse_flags(struct parser_state *state, int arg1, int ar
 /**
  * Parse -fls FILE.
  */
-static struct bfs_expr *parse_fls(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_action(state, eval_fls);
+static struct bfs_expr *parse_fls(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_action(parser, eval_fls);
 	if (!expr) {
-		goto fail;
+		return NULL;
 	}
 
-	if (expr_open(state, expr, expr->argv[1]) != 0) {
-		goto fail;
+	if (expr_open(parser, expr, expr->argv[1]) != 0) {
+		return NULL;
 	}
 
-	expr_set_always_true(expr);
-	expr->cost = PRINT_COST;
-	expr->reftime = state->now;
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -fprint FILE.
  */
-static struct bfs_expr *parse_fprint(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_action(state, eval_fprint);
-	if (expr) {
-		expr_set_always_true(expr);
-		expr->cost = PRINT_COST;
-		if (expr_open(state, expr, expr->argv[1]) != 0) {
-			goto fail;
-		}
+static struct bfs_expr *parse_fprint(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_action(parser, eval_fprint);
+	if (!expr) {
+		return NULL;
 	}
-	return expr;
 
-fail:
-	bfs_expr_free(expr);
-	return NULL;
+	if (expr_open(parser, expr, expr->argv[1]) != 0) {
+		return NULL;
+	}
+
+	return expr;
 }
 
 /**
  * Parse -fprint0 FILE.
  */
-static struct bfs_expr *parse_fprint0(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_action(state, eval_fprint0);
-	if (expr) {
-		expr_set_always_true(expr);
-		expr->cost = PRINT_COST;
-		if (expr_open(state, expr, expr->argv[1]) != 0) {
-			goto fail;
-		}
+static struct bfs_expr *parse_fprint0(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_action(parser, eval_fprint0);
+	if (!expr) {
+		return NULL;
 	}
-	return expr;
 
-fail:
-	bfs_expr_free(expr);
-	return NULL;
+	if (expr_open(parser, expr, expr->argv[1]) != 0) {
+		return NULL;
+	}
+
+	return expr;
 }
 
 /**
  * Parse -fprintf FILE FORMAT.
  */
-static struct bfs_expr *parse_fprintf(struct parser_state *state, int arg1, int arg2) {
-	const char *arg = state->argv[0];
+static struct bfs_expr *parse_fprintf(struct bfs_parser *parser, int arg1, int arg2) {
+	const char *arg = parser->argv[0];
 
-	const char *file = state->argv[1];
+	const char *file = parser->argv[1];
 	if (!file) {
-		parse_error(state, "${blu}%s${rs} needs a file.\n", arg);
+		parse_error(parser, "${blu}%s${rs} needs a file.\n", arg);
 		return NULL;
 	}
 
-	const char *format = state->argv[2];
+	const char *format = parser->argv[2];
 	if (!format) {
-		parse_error(state, "${blu}%s${rs} needs a format string.\n", arg);
+		parse_error(parser, "${blu}%s${rs} needs a format string.\n", arg);
 		return NULL;
 	}
 
-	struct bfs_expr *expr = parse_action(state, eval_fprintf, 3);
+	struct bfs_expr *expr = parse_action(parser, eval_fprintf, 3);
 	if (!expr) {
 		return NULL;
 	}
 
-	expr_set_always_true(expr);
-
-	expr->cost = PRINT_COST;
-
-	if (expr_open(state, expr, file) != 0) {
-		goto fail;
+	if (expr_open(parser, expr, file) != 0) {
+		return NULL;
 	}
 
-	if (bfs_printf_parse(state->ctx, expr, format) != 0) {
-		goto fail;
+	if (bfs_printf_parse(parser->ctx, expr, format) != 0) {
+		return NULL;
 	}
 
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -fstype TYPE.
  */
-static struct bfs_expr *parse_fstype(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_fstype);
+static struct bfs_expr *parse_fstype(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_fstype);
 	if (!expr) {
 		return NULL;
 	}
 
-	if (!bfs_ctx_mtab(state->ctx)) {
-		parse_expr_error(state, expr, "Couldn't parse the mount table: %m.\n");
-		bfs_expr_free(expr);
+	if (!bfs_ctx_mtab(parser->ctx)) {
+		parse_expr_error(parser, expr, "Couldn't parse the mount table: %m.\n");
 		return NULL;
 	}
 
-	expr->cost = STAT_COST;
 	return expr;
 }
 
 /**
  * Parse -gid/-group.
  */
-static struct bfs_expr *parse_group(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_gid);
+static struct bfs_expr *parse_group(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_gid);
 	if (!expr) {
 		return NULL;
 	}
 
-	const struct group *grp = bfs_getgrnam(state->ctx->groups, expr->argv[1]);
+	const struct group *grp = bfs_getgrnam(parser->ctx->groups, expr->argv[1]);
 	if (grp) {
 		expr->num = grp->gr_gid;
 		expr->int_cmp = BFS_INT_EQUAL;
 	} else if (looks_like_icmp(expr->argv[1])) {
-		if (!parse_icmp(state, expr, 0)) {
-			goto fail;
+		if (!parse_icmp(parser, expr, 0)) {
+			return NULL;
 		}
 	} else if (errno) {
-		parse_expr_error(state, expr, "%m.\n");
-		goto fail;
+		parse_expr_error(parser, expr, "%m.\n");
+		return NULL;
 	} else {
-		parse_expr_error(state, expr, "No such group.\n");
-		goto fail;
+		parse_expr_error(parser, expr, "No such group.\n");
+		return NULL;
 	}
 
-	expr->cost = STAT_COST;
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -unique.
  */
-static struct bfs_expr *parse_unique(struct parser_state *state, int arg1, int arg2) {
-	state->ctx->unique = true;
-	return parse_nullary_option(state);
+static struct bfs_expr *parse_unique(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->ctx->unique = true;
+	return parse_nullary_option(parser);
 }
 
 /**
  * Parse -used N.
  */
-static struct bfs_expr *parse_used(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_test_icmp(state, eval_used);
-	if (expr) {
-		expr->cost = STAT_COST;
-	}
-	return expr;
+static struct bfs_expr *parse_used(struct bfs_parser *parser, int arg1, int arg2) {
+	return parse_test_icmp(parser, eval_used);
 }
 
 /**
  * Parse -uid/-user.
  */
-static struct bfs_expr *parse_user(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_uid);
+static struct bfs_expr *parse_user(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_uid);
 	if (!expr) {
 		return NULL;
 	}
 
-	const struct passwd *pwd = bfs_getpwnam(state->ctx->users, expr->argv[1]);
+	const struct passwd *pwd = bfs_getpwnam(parser->ctx->users, expr->argv[1]);
 	if (pwd) {
 		expr->num = pwd->pw_uid;
 		expr->int_cmp = BFS_INT_EQUAL;
 	} else if (looks_like_icmp(expr->argv[1])) {
-		if (!parse_icmp(state, expr, 0)) {
-			goto fail;
+		if (!parse_icmp(parser, expr, 0)) {
+			return NULL;
 		}
 	} else if (errno) {
-		parse_expr_error(state, expr, "%m.\n");
-		goto fail;
+		parse_expr_error(parser, expr, "%m.\n");
+		return NULL;
 	} else {
-		parse_expr_error(state, expr, "No such user.\n");
-		goto fail;
+		parse_expr_error(parser, expr, "No such user.\n");
+		return NULL;
 	}
 
-	expr->cost = STAT_COST;
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -hidden.
  */
-static struct bfs_expr *parse_hidden(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_test(state, eval_hidden);
-	if (expr) {
-		expr->probability = 0.01;
-	}
-	return expr;
+static struct bfs_expr *parse_hidden(struct bfs_parser *parser, int arg1, int arg2) {
+	return parse_nullary_test(parser, eval_hidden);
 }
 
 /**
  * Parse -(no)?ignore_readdir_race.
  */
-static struct bfs_expr *parse_ignore_races(struct parser_state *state, int ignore, int arg2) {
-	state->ctx->ignore_races = ignore;
-	return parse_nullary_option(state);
+static struct bfs_expr *parse_ignore_races(struct bfs_parser *parser, int ignore, int arg2) {
+	parser->ctx->ignore_races = ignore;
+	return parse_nullary_option(parser);
 }
 
 /**
  * Parse -inum N.
  */
-static struct bfs_expr *parse_inum(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_test_icmp(state, eval_inum);
-	if (expr) {
-		expr->cost = STAT_COST;
-		expr->probability = expr->int_cmp == BFS_INT_EQUAL ? 0.01 : 0.50;
-	}
-	return expr;
+static struct bfs_expr *parse_inum(struct bfs_parser *parser, int arg1, int arg2) {
+	return parse_test_icmp(parser, eval_inum);
 }
 
 /**
- * Parse -links N.
+ * Parse -j<n>.
  */
-static struct bfs_expr *parse_links(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_test_icmp(state, eval_links);
-	if (expr) {
-		expr->cost = STAT_COST;
-		expr->probability = bfs_expr_cmp(expr, 1) ? 0.99 : 0.01;
+static struct bfs_expr *parse_jobs(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_flag(parser);
+	if (!expr) {
+		return NULL;
 	}
+
+	unsigned int n;
+	if (!parse_int(parser, expr->argv, expr->argv[0] + 2, &n, IF_INT | IF_UNSIGNED)) {
+		return NULL;
+	}
+
+	if (n == 0) {
+		parse_expr_error(parser, expr, "${bld}0${rs} is not enough threads.\n");
+		return NULL;
+	}
+
+	parser->ctx->threads = n;
 	return expr;
 }
 
 /**
- * Parse -ls.
+ * Parse -limit N.
  */
-static struct bfs_expr *parse_ls(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_action(state, eval_fls);
+static struct bfs_expr *parse_limit(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_action(parser, eval_limit);
 	if (!expr) {
 		return NULL;
 	}
 
-	init_print_expr(state, expr);
-	expr->reftime = state->now;
+	char **arg = &expr->argv[1];
+	if (!parse_int(parser, arg, *arg, &expr->num, IF_LONG_LONG)) {
+		return NULL;
+	}
+
+	if (expr->num <= 0) {
+		parse_expr_error(parser, expr, "The ${blu}%s${rs} must be at least ${bld}1${rs}.\n", expr->argv[0]);
+		return NULL;
+	}
+
+	parser->limit_arg = expr->argv;
 	return expr;
 }
 
 /**
- * Parse -mount.
+ * Parse -links N.
  */
-static struct bfs_expr *parse_mount(struct parser_state *state, int arg1, int arg2) {
-	parse_warning(state, "In the future, ${blu}%s${rs} will skip mount points entirely, unlike\n", state->argv[0]);
-	bfs_warning(state->ctx, "${blu}-xdev${rs}, due to http://austingroupbugs.net/view.php?id=1133.\n\n");
-
-	state->ctx->flags |= BFTW_PRUNE_MOUNTS;
-	state->mount_arg = state->argv;
-	return parse_nullary_option(state);
+static struct bfs_expr *parse_links(struct bfs_parser *parser, int arg1, int arg2) {
+	return parse_test_icmp(parser, eval_links);
 }
 
 /**
- * Common code for fnmatch() tests.
+ * Parse -ls.
  */
-static struct bfs_expr *parse_fnmatch(const struct parser_state *state, struct bfs_expr *expr, bool casefold) {
+static struct bfs_expr *parse_ls(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_action(parser, eval_fls);
 	if (!expr) {
 		return NULL;
 	}
 
-	if (casefold) {
-#ifdef FNM_CASEFOLD
-		expr->num = FNM_CASEFOLD;
-#else
-		parse_expr_error(state, expr, "Missing platform support.\n");
-		bfs_expr_free(expr);
-		return NULL;
-#endif
-	} else {
-		expr->num = 0;
-	}
+	init_print_expr(parser, expr);
+	return expr;
+}
 
-	// POSIX says, about fnmatch():
-	//
-	//     If pattern ends with an unescaped <backslash>, fnmatch() shall
-	//     return a non-zero value (indicating either no match or an error).
-	//
-	// But not all implementations obey this, so check for it ourselves.
-	const char *pattern = expr->argv[1];
-	size_t i, len = strlen(pattern);
-	for (i = 0; i < len; ++i) {
-		if (pattern[len - i - 1] != '\\') {
-			break;
-		}
-	}
-	if (i % 2 != 0) {
-		parse_expr_warning(state, expr, "Unescaped trailing backslash.\n\n");
-		bfs_expr_free(expr);
-		return &bfs_false;
+/**
+ * Parse -mount.
+ */
+static struct bfs_expr *parse_mount(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_option(parser);
+	if (!expr) {
+		return NULL;
 	}
 
-	expr->cost = 400.0;
-
-	if (strchr(pattern, '*')) {
-		expr->probability = 0.5;
-	} else {
-		expr->probability = 0.1;
-	}
+	parse_expr_warning(parser, expr, "In the future, ${blu}%s${rs} will skip mount points entirely, unlike\n", expr->argv[0]);
+	bfs_warning(parser->ctx, "${blu}-xdev${rs}, due to http://austingroupbugs.net/view.php?id=1133.\n\n");
 
+	parser->ctx->flags |= BFTW_PRUNE_MOUNTS;
+	parser->mount_arg = expr->argv;
 	return expr;
 }
 
 /**
  * Parse -i?name.
  */
-static struct bfs_expr *parse_name(struct parser_state *state, int casefold, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_name);
-	return parse_fnmatch(state, expr, casefold);
+static struct bfs_expr *parse_name(struct bfs_parser *parser, int casefold, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_name);
+	return parse_fnmatch(parser, expr, casefold);
 }
 
 /**
  * Parse -i?path, -i?wholename.
  */
-static struct bfs_expr *parse_path(struct parser_state *state, int casefold, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_path);
-	return parse_fnmatch(state, expr, casefold);
+static struct bfs_expr *parse_path(struct bfs_parser *parser, int casefold, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_path);
+	return parse_fnmatch(parser, expr, casefold);
 }
 
 /**
  * Parse -i?lname.
  */
-static struct bfs_expr *parse_lname(struct parser_state *state, int casefold, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_lname);
-	return parse_fnmatch(state, expr, casefold);
+static struct bfs_expr *parse_lname(struct bfs_parser *parser, int casefold, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_lname);
+	return parse_fnmatch(parser, expr, casefold);
 }
 
 /** Get the bfs_stat_field for X/Y in -newerXY. */
@@ -1879,20 +1733,20 @@ static enum bfs_stat_field parse_newerxy_field(char c) {
 }
 
 /** Parse an explicit reference timestamp for -newerXt and -*since. */
-static int parse_reftime(const struct parser_state *state, struct bfs_expr *expr) {
+static int parse_reftime(const struct bfs_parser *parser, struct bfs_expr *expr) {
 	if (xgetdate(expr->argv[1], &expr->reftime) == 0) {
 		return 0;
 	} else if (errno != EINVAL) {
-		parse_expr_error(state, expr, "%m.\n");
+		parse_expr_error(parser, expr, "%m.\n");
 		return -1;
 	}
 
-	parse_expr_error(state, expr, "Invalid timestamp.\n\n");
+	parse_expr_error(parser, expr, "Invalid timestamp.\n\n");
 	fprintf(stderr, "Supported timestamp formats are ISO 8601-like, e.g.\n\n");
 
 	struct tm tm;
-	if (xlocaltime(&state->now.tv_sec, &tm) != 0) {
-		parse_perror(state, "xlocaltime()");
+	if (!localtime_r(&parser->now.tv_sec, &tm)) {
+		parse_perror(parser, "localtime_r()");
 		return -1;
 	}
 
@@ -1901,18 +1755,18 @@ static int parse_reftime(const struct parser_state *state, struct bfs_expr *expr
 	fprintf(stderr, "  - %04d-%02d-%02d\n", year, month, tm.tm_mday);
 	fprintf(stderr, "  - %04d-%02d-%02dT%02d:%02d:%02d\n", year, month, tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec);
 
-#if __FreeBSD__
+#if BFS_HAS_TM_GMTOFF
 	int gmtoff = tm.tm_gmtoff;
 #else
 	int gmtoff = -timezone;
 #endif
-	int tz_hour = gmtoff/3600;
-	int tz_min = (labs(gmtoff)/60)%60;
+	int tz_hour = gmtoff / 3600;
+	int tz_min = (labs(gmtoff) / 60) % 60;
 	fprintf(stderr, "  - %04d-%02d-%02dT%02d:%02d:%02d%+03d:%02d\n",
-	        year, month, tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec, tz_hour, tz_min);
+		year, month, tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec, tz_hour, tz_min);
 
-	if (xgmtime(&state->now.tv_sec, &tm) != 0) {
-		parse_perror(state, "xgmtime()");
+	if (!gmtime_r(&parser->now.tv_sec, &tm)) {
+		parse_perror(parser, "gmtime_r()");
 		return -1;
 	}
 
@@ -1926,138 +1780,109 @@ static int parse_reftime(const struct parser_state *state, struct bfs_expr *expr
 /**
  * Parse -newerXY.
  */
-static struct bfs_expr *parse_newerxy(struct parser_state *state, int arg1, int arg2) {
-	const char *arg = state->argv[0];
+static struct bfs_expr *parse_newerxy(struct bfs_parser *parser, int arg1, int arg2) {
+	const char *arg = parser->argv[0];
 	if (strlen(arg) != 8) {
-		parse_error(state, "Expected ${blu}-newer${bld}XY${rs}; found ${blu}-newer${bld}%s${rs}.\n", arg + 6);
+		parse_error(parser, "Expected ${blu}-newer${bld}XY${rs}; found ${blu}-newer${bld}%pq${rs}.\n", arg + 6);
 		return NULL;
 	}
 
-	struct bfs_expr *expr = parse_unary_test(state, eval_newer);
+	struct bfs_expr *expr = parse_unary_test(parser, eval_newer);
 	if (!expr) {
-		goto fail;
+		return NULL;
 	}
 
 	expr->stat_field = parse_newerxy_field(arg[6]);
 	if (!expr->stat_field) {
-		parse_expr_error(state, expr,
-		                 "For ${blu}-newer${bld}XY${rs}, ${bld}X${rs} should be ${bld}a${rs}, ${bld}c${rs}, ${bld}m${rs}, or ${bld}B${rs}, not ${err}%c${rs}.\n",
-		                 arg[6]);
-		goto fail;
+		parse_expr_error(parser, expr,
+			"For ${blu}-newer${bld}XY${rs}, ${bld}X${rs} should be ${bld}a${rs}, ${bld}c${rs}, ${bld}m${rs}, or ${bld}B${rs}, not ${err}%c${rs}.\n",
+			arg[6]);
+		return NULL;
 	}
 
 	if (arg[7] == 't') {
-		if (parse_reftime(state, expr) != 0) {
-			goto fail;
+		if (parse_reftime(parser, expr) != 0) {
+			return NULL;
 		}
 	} else {
 		enum bfs_stat_field field = parse_newerxy_field(arg[7]);
 		if (!field) {
-			parse_expr_error(state, expr,
-			                 "For ${blu}-newer${bld}XY${rs}, ${bld}Y${rs} should be ${bld}a${rs}, ${bld}c${rs}, ${bld}m${rs}, ${bld}B${rs}, or ${bld}t${rs}, not ${err}%c${rs}.\n",
-			                 arg[7]);
-			goto fail;
+			parse_expr_error(parser, expr,
+				"For ${blu}-newer${bld}XY${rs}, ${bld}Y${rs} should be ${bld}a${rs}, ${bld}c${rs}, ${bld}m${rs}, ${bld}B${rs}, or ${bld}t${rs}, not ${err}%c${rs}.\n",
+				arg[7]);
+			return NULL;
 		}
 
 		struct bfs_stat sb;
-		if (stat_arg(state, &expr->argv[1], &sb) != 0) {
-			goto fail;
+		if (stat_arg(parser, &expr->argv[1], &sb) != 0) {
+			return NULL;
 		}
 
-
 		const struct timespec *reftime = bfs_stat_time(&sb, field);
 		if (!reftime) {
-			parse_expr_error(state, expr, "Couldn't get file %s.\n", bfs_stat_field_name(field));
-			goto fail;
+			parse_expr_error(parser, expr, "Couldn't get file %s.\n", bfs_stat_field_name(field));
+			return NULL;
 		}
 
 		expr->reftime = *reftime;
 	}
 
-	expr->cost = STAT_COST;
-
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -nogroup.
  */
-static struct bfs_expr *parse_nogroup(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_test(state, eval_nogroup);
-	if (!expr) {
-		return NULL;
+static struct bfs_expr *parse_nogroup(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_test(parser, eval_nogroup);
+	if (expr) {
+		// Who knows how many FDs getgrgid_r() needs?
+		expr->ephemeral_fds = 3;
 	}
-
-	expr->cost = STAT_COST;
-	expr->probability = 0.01;
-
-	// Who knows how many FDs getgrgid_r() needs?  Probably at least one for
-	// /etc/group
-	expr->ephemeral_fds = 1;
-
 	return expr;
 }
 
 /**
  * Parse -nohidden.
  */
-static struct bfs_expr *parse_nohidden(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *hidden = bfs_expr_new(eval_hidden, 1, &fake_hidden_arg);
+static struct bfs_expr *parse_nohidden(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *hidden = parse_new_expr(parser, eval_hidden, 1, &fake_hidden_arg);
 	if (!hidden) {
 		return NULL;
 	}
 
-	hidden->probability = 0.01;
-	hidden->pure = true;
-	hidden->synthetic = true;
-
-	if (parse_exclude(state, hidden) != 0) {
-		return NULL;
-	}
-
-	parser_advance(state, T_OPTION, 1);
-	return &bfs_true;
+	bfs_expr_append(parser->ctx->exclude, hidden);
+	return parse_nullary_option(parser);
 }
 
 /**
  * Parse -noleaf.
  */
-static struct bfs_expr *parse_noleaf(struct parser_state *state, int arg1, int arg2) {
-	parse_warning(state, "${ex}%s${rs} does not apply the optimization that ${blu}%s${rs} inhibits.\n\n",
-	              BFS_COMMAND, state->argv[0]);
-	return parse_nullary_option(state);
+static struct bfs_expr *parse_noleaf(struct bfs_parser *parser, int arg1, int arg2) {
+	parse_warning(parser, "${ex}%s${rs} does not apply the optimization that ${blu}%s${rs} inhibits.\n\n",
+		BFS_COMMAND, parser->argv[0]);
+	return parse_nullary_option(parser);
 }
 
 /**
  * Parse -nouser.
  */
-static struct bfs_expr *parse_nouser(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_test(state, eval_nouser);
-	if (!expr) {
-		return NULL;
+static struct bfs_expr *parse_nouser(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_test(parser, eval_nouser);
+	if (expr) {
+		// Who knows how many FDs getpwuid_r() needs?
+		expr->ephemeral_fds = 3;
 	}
-
-	expr->cost = STAT_COST;
-	expr->probability = 0.01;
-
-	// Who knows how many FDs getpwuid_r() needs?  Probably at least one for
-	// /etc/passwd
-	expr->ephemeral_fds = 1;
-
 	return expr;
 }
 
 /**
  * Parse a permission mode like chmod(1).
  */
-static int parse_mode(const struct parser_state *state, const char *mode, struct bfs_expr *expr) {
+static int parse_mode(const struct bfs_parser *parser, const char *mode, struct bfs_expr *expr) {
 	if (mode[0] >= '0' && mode[0] <= '9') {
 		unsigned int parsed;
-		if (!parse_int(state, NULL, mode, &parsed, 8 | IF_INT | IF_UNSIGNED | IF_QUIET)) {
+		if (!parse_int(parser, NULL, mode, &parsed, 8 | IF_INT | IF_UNSIGNED | IF_QUIET)) {
 			goto fail;
 		}
 		if (parsed > 07777) {
@@ -2089,7 +1914,7 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 	//
 	// PERMCOPY : "u" | "g" | "o"
 
-	// State machine state
+	// Parser machine parser
 	enum {
 		MODE_CLAUSE,
 		MODE_WHO,
@@ -2097,25 +1922,25 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 		MODE_ACTION_APPLY,
 		MODE_OP,
 		MODE_PERM,
-	} mstate = MODE_CLAUSE;
+	} mparser = MODE_CLAUSE;
 
 	enum {
 		MODE_PLUS,
 		MODE_MINUS,
 		MODE_EQUALS,
-	} op;
+	} op uninit(MODE_EQUALS);
 
-	mode_t who;
-	mode_t file_change;
-	mode_t dir_change;
+	mode_t who uninit(0);
+	mode_t file_change uninit(0);
+	mode_t dir_change uninit(0);
 
 	const char *i = mode;
 	while (true) {
-		switch (mstate) {
+		switch (mparser) {
 		case MODE_CLAUSE:
 			who = 0;
-			mstate = MODE_WHO;
-			BFS_FALLTHROUGH;
+			mparser = MODE_WHO;
+			fallthru;
 
 		case MODE_WHO:
 			switch (*i) {
@@ -2132,7 +1957,7 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 				who |= 0777;
 				break;
 			default:
-				mstate = MODE_ACTION;
+				mparser = MODE_ACTION;
 				continue;
 			}
 			break;
@@ -2142,7 +1967,7 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 			case MODE_EQUALS:
 				expr->file_mode &= ~who;
 				expr->dir_mode &= ~who;
-				BFS_FALLTHROUGH;
+				fallthru;
 			case MODE_PLUS:
 				expr->file_mode |= file_change;
 				expr->dir_mode |= dir_change;
@@ -2152,7 +1977,7 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 				expr->dir_mode &= ~dir_change;
 				break;
 			}
-			BFS_FALLTHROUGH;
+			fallthru;
 
 		case MODE_ACTION:
 			if (who == 0) {
@@ -2162,27 +1987,27 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 			switch (*i) {
 			case '+':
 				op = MODE_PLUS;
-				mstate = MODE_OP;
+				mparser = MODE_OP;
 				break;
 			case '-':
 				op = MODE_MINUS;
-				mstate = MODE_OP;
+				mparser = MODE_OP;
 				break;
 			case '=':
 				op = MODE_EQUALS;
-				mstate = MODE_OP;
+				mparser = MODE_OP;
 				break;
 
 			case ',':
-				if (mstate == MODE_ACTION_APPLY) {
-					mstate = MODE_CLAUSE;
+				if (mparser == MODE_ACTION_APPLY) {
+					mparser = MODE_CLAUSE;
 				} else {
 					goto fail;
 				}
 				break;
 
 			case '\0':
-				if (mstate == MODE_ACTION_APPLY) {
+				if (mparser == MODE_ACTION_APPLY) {
 					goto done;
 				} else {
 					goto fail;
@@ -2211,7 +2036,7 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 			default:
 				file_change = 0;
 				dir_change = 0;
-				mstate = MODE_PERM;
+				mparser = MODE_PERM;
 				continue;
 			}
 
@@ -2219,7 +2044,7 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 			file_change &= who;
 			dir_change |= (dir_change << 6) | (dir_change << 3);
 			dir_change &= who;
-			mstate = MODE_ACTION_APPLY;
+			mparser = MODE_ACTION_APPLY;
 			break;
 
 		case MODE_PERM:
@@ -2234,7 +2059,7 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 				break;
 			case 'x':
 				file_change |= who & 0111;
-				BFS_FALLTHROUGH;
+				fallthru;
 			case 'X':
 				dir_change |= who & 0111;
 				break;
@@ -2255,7 +2080,7 @@ static int parse_mode(const struct parser_state *state, const char *mode, struct
 				}
 				break;
 			default:
-				mstate = MODE_ACTION_APPLY;
+				mparser = MODE_ACTION_APPLY;
 				continue;
 			}
 			break;
@@ -2268,15 +2093,15 @@ done:
 	return 0;
 
 fail:
-	parse_expr_error(state, expr, "Invalid mode.\n");
+	parse_expr_error(parser, expr, "Invalid mode.\n");
 	return -1;
 }
 
 /**
  * Parse -perm MODE.
  */
-static struct bfs_expr *parse_perm(struct parser_state *state, int field, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_perm);
+static struct bfs_expr *parse_perm(struct bfs_parser *parser, int field, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_perm);
 	if (!expr) {
 		return NULL;
 	}
@@ -2297,32 +2122,26 @@ static struct bfs_expr *parse_perm(struct parser_state *state, int field, int ar
 			++mode;
 			break;
 		}
-		BFS_FALLTHROUGH;
+		fallthru;
 	default:
 		expr->mode_cmp = BFS_MODE_EQUAL;
 		break;
 	}
 
-	if (parse_mode(state, mode, expr) != 0) {
-		goto fail;
+	if (parse_mode(parser, mode, expr) != 0) {
+		return NULL;
 	}
 
-	expr->cost = STAT_COST;
-
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -print.
  */
-static struct bfs_expr *parse_print(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_action(state, eval_fprint);
+static struct bfs_expr *parse_print(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_action(parser, eval_fprint);
 	if (expr) {
-		init_print_expr(state, expr);
+		init_print_expr(parser, expr);
 	}
 	return expr;
 }
@@ -2330,10 +2149,10 @@ static struct bfs_expr *parse_print(struct parser_state *state, int arg1, int ar
 /**
  * Parse -print0.
  */
-static struct bfs_expr *parse_print0(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_action(state, eval_fprint0);
+static struct bfs_expr *parse_print0(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_action(parser, eval_fprint0);
 	if (expr) {
-		init_print_expr(state, expr);
+		init_print_expr(parser, expr);
 	}
 	return expr;
 }
@@ -2341,16 +2160,15 @@ static struct bfs_expr *parse_print0(struct parser_state *state, int arg1, int a
 /**
  * Parse -printf FORMAT.
  */
-static struct bfs_expr *parse_printf(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_action(state, eval_fprintf);
+static struct bfs_expr *parse_printf(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_action(parser, eval_fprintf);
 	if (!expr) {
 		return NULL;
 	}
 
-	init_print_expr(state, expr);
+	init_print_expr(parser, expr);
 
-	if (bfs_printf_parse(state->ctx, expr, expr->argv[1]) != 0) {
-		bfs_expr_free(expr);
+	if (bfs_printf_parse(parser->ctx, expr, expr->argv[1]) != 0) {
 		return NULL;
 	}
 
@@ -2360,10 +2178,10 @@ static struct bfs_expr *parse_printf(struct parser_state *state, int arg1, int a
 /**
  * Parse -printx.
  */
-static struct bfs_expr *parse_printx(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_action(state, eval_fprintx);
+static struct bfs_expr *parse_printx(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_nullary_action(parser, eval_fprintx);
 	if (expr) {
-		init_print_expr(state, expr);
+		init_print_expr(parser, expr);
 	}
 	return expr;
 }
@@ -2371,115 +2189,98 @@ static struct bfs_expr *parse_printx(struct parser_state *state, int arg1, int a
 /**
  * Parse -prune.
  */
-static struct bfs_expr *parse_prune(struct parser_state *state, int arg1, int arg2) {
-	state->prune_arg = state->argv;
-
-	struct bfs_expr *expr = parse_nullary_action(state, eval_prune);
-	if (expr) {
-		expr_set_always_true(expr);
-	}
-	return expr;
+static struct bfs_expr *parse_prune(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->prune_arg = parser->argv;
+	return parse_nullary_action(parser, eval_prune);
 }
 
 /**
  * Parse -quit.
  */
-static struct bfs_expr *parse_quit(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_action(state, eval_quit);
-	if (expr) {
-		expr_set_never_returns(expr);
-	}
-	return expr;
+static struct bfs_expr *parse_quit(struct bfs_parser *parser, int arg1, int arg2) {
+	return parse_nullary_action(parser, eval_quit);
 }
 
 /**
  * Parse -i?regex.
  */
-static struct bfs_expr *parse_regex(struct parser_state *state, int flags, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_regex);
+static struct bfs_expr *parse_regex(struct bfs_parser *parser, int flags, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_regex);
 	if (!expr) {
-		goto fail;
+		return NULL;
 	}
 
-	if (bfs_regcomp(&expr->regex, expr->argv[1], state->regex_type, flags) != 0) {
-		if (!expr->regex) {
-			parse_perror(state, "bfs_regcomp()");
-			goto fail;
-		}
-
-		char *str = bfs_regerror(expr->regex);
-		if (!str) {
-			parse_perror(state, "bfs_regerror()");
-			goto fail;
+	if (bfs_regcomp(&expr->regex, expr->argv[1], parser->regex_type, flags) != 0) {
+		if (expr->regex) {
+			char *str = bfs_regerror(expr->regex);
+			if (str) {
+				parse_expr_error(parser, expr, "%s.\n", str);
+				free(str);
+			} else {
+				parse_perror(parser, "bfs_regerror()");
+			}
+		} else {
+			parse_perror(parser, "bfs_regcomp()");
 		}
 
-		parse_expr_error(state, expr, "%s.\n", str);
-		free(str);
-		goto fail;
+		return NULL;
 	}
 
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -E.
  */
-static struct bfs_expr *parse_regex_extended(struct parser_state *state, int arg1, int arg2) {
-	state->regex_type = BFS_REGEX_POSIX_EXTENDED;
-	return parse_nullary_flag(state);
+static struct bfs_expr *parse_regex_extended(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->regex_type = BFS_REGEX_POSIX_EXTENDED;
+	return parse_nullary_flag(parser);
 }
 
 /**
  * Parse -regextype TYPE.
  */
-static struct bfs_expr *parse_regextype(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_ctx *ctx = state->ctx;
+static struct bfs_expr *parse_regextype(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_ctx *ctx = parser->ctx;
 	CFILE *cfile = ctx->cerr;
 
-	const char *arg = state->argv[0];
-	const char *type = state->argv[1];
-	if (!type) {
-		parse_error(state, "${blu}%s${rs} needs a value.\n\n", arg);
+	struct bfs_expr *expr = parse_unary_option(parser);
+	if (!expr) {
+		cfprintf(cfile, "\n");
 		goto list_types;
 	}
 
-	parser_advance(state, T_OPTION, 1);
-
 	// See https://www.gnu.org/software/gnulib/manual/html_node/Predefined-Syntaxes.html
+	const char *type = expr->argv[1];
 	if (strcmp(type, "posix-basic") == 0
 	    || strcmp(type, "ed") == 0
 	    || strcmp(type, "sed") == 0) {
-		state->regex_type = BFS_REGEX_POSIX_BASIC;
+		parser->regex_type = BFS_REGEX_POSIX_BASIC;
 	} else if (strcmp(type, "posix-extended") == 0) {
-		state->regex_type = BFS_REGEX_POSIX_EXTENDED;
-#if BFS_WITH_ONIGURUMA
+		parser->regex_type = BFS_REGEX_POSIX_EXTENDED;
+#if BFS_USE_ONIGURUMA
 	} else if (strcmp(type, "emacs") == 0) {
-		state->regex_type = BFS_REGEX_EMACS;
+		parser->regex_type = BFS_REGEX_EMACS;
 	} else if (strcmp(type, "grep") == 0) {
-		state->regex_type = BFS_REGEX_GREP;
+		parser->regex_type = BFS_REGEX_GREP;
 #endif
 	} else if (strcmp(type, "help") == 0) {
-		state->just_info = true;
+		parser->just_info = true;
 		cfile = ctx->cout;
 		goto list_types;
 	} else {
-		parse_error(state, "Unsupported regex type.\n\n");
+		parse_expr_error(parser, expr, "Unsupported regex type.\n\n");
 		goto list_types;
 	}
 
-	parser_advance(state, T_OPTION, 1);
-	return &bfs_true;
+	return expr;
 
 list_types:
 	cfprintf(cfile, "Supported types are:\n\n");
 	cfprintf(cfile, "  ${bld}posix-basic${rs}:    POSIX basic regular expressions (BRE)\n");
 	cfprintf(cfile, "  ${bld}posix-extended${rs}: POSIX extended regular expressions (ERE)\n");
 	cfprintf(cfile, "  ${bld}ed${rs}:             Like ${grn}ed${rs} (same as ${bld}posix-basic${rs})\n");
-#if BFS_WITH_ONIGURUMA
+#if BFS_USE_ONIGURUMA
 	cfprintf(cfile, "  ${bld}emacs${rs}:          Like ${grn}emacs${rs}\n");
 	cfprintf(cfile, "  ${bld}grep${rs}:           Like ${grn}grep${rs}\n");
 #endif
@@ -2490,51 +2291,44 @@ list_types:
 /**
  * Parse -s.
  */
-static struct bfs_expr *parse_s(struct parser_state *state, int arg1, int arg2) {
-	state->ctx->flags |= BFTW_SORT;
-	return parse_nullary_flag(state);
+static struct bfs_expr *parse_s(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->ctx->flags |= BFTW_SORT;
+	return parse_nullary_flag(parser);
 }
 
 /**
  * Parse -samefile FILE.
  */
-static struct bfs_expr *parse_samefile(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_samefile);
+static struct bfs_expr *parse_samefile(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_samefile);
 	if (!expr) {
 		return NULL;
 	}
 
 	struct bfs_stat sb;
-	if (stat_arg(state, &expr->argv[1], &sb) != 0) {
-		bfs_expr_free(expr);
+	if (stat_arg(parser, &expr->argv[1], &sb) != 0) {
 		return NULL;
 	}
 
 	expr->dev = sb.dev;
 	expr->ino = sb.ino;
-
-	expr->cost = STAT_COST;
-	expr->probability = 0.01;
-
 	return expr;
 }
 
 /**
  * Parse -S STRATEGY.
  */
-static struct bfs_expr *parse_search_strategy(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_ctx *ctx = state->ctx;
+static struct bfs_expr *parse_search_strategy(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_ctx *ctx = parser->ctx;
 	CFILE *cfile = ctx->cerr;
 
-	const char *flag = state->argv[0];
-	const char *arg = state->argv[1];
-	if (!arg) {
-		parse_error(state, "${cyn}%s${rs} needs an argument.\n\n", flag);
+	struct bfs_expr *expr = parse_unary_flag(parser);
+	if (!expr) {
+		cfprintf(cfile, "\n");
 		goto list_strategies;
 	}
 
-	parser_advance(state, T_FLAG, 1);
-
+	const char *arg = expr->argv[1];
 	if (strcmp(arg, "bfs") == 0) {
 		ctx->strategy = BFTW_BFS;
 	} else if (strcmp(arg, "dfs") == 0) {
@@ -2544,16 +2338,15 @@ static struct bfs_expr *parse_search_strategy(struct parser_state *state, int ar
 	} else if (strcmp(arg, "eds") == 0) {
 		ctx->strategy = BFTW_EDS;
 	} else if (strcmp(arg, "help") == 0) {
-		state->just_info = true;
+		parser->just_info = true;
 		cfile = ctx->cout;
 		goto list_strategies;
 	} else {
-		parse_error(state, "Unrecognized search strategy.\n\n");
+		parse_expr_error(parser, expr, "Unrecognized search strategy.\n\n");
 		goto list_strategies;
 	}
 
-	parser_advance(state, T_FLAG, 1);
-	return &bfs_true;
+	return expr;
 
 list_strategies:
 	cfprintf(cfile, "Supported search strategies:\n\n");
@@ -2567,37 +2360,32 @@ list_strategies:
 /**
  * Parse -[aBcm]?since.
  */
-static struct bfs_expr *parse_since(struct parser_state *state, int field, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_newer);
+static struct bfs_expr *parse_since(struct bfs_parser *parser, int field, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_newer);
 	if (!expr) {
 		return NULL;
 	}
 
-	if (parse_reftime(state, expr) != 0) {
-		goto fail;
+	if (parse_reftime(parser, expr) != 0) {
+		return NULL;
 	}
 
-	expr->cost = STAT_COST;
 	expr->stat_field = field;
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -size N[cwbkMGTP]?.
  */
-static struct bfs_expr *parse_size(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_unary_test(state, eval_size);
+static struct bfs_expr *parse_size(struct bfs_parser *parser, int arg1, int arg2) {
+	struct bfs_expr *expr = parse_unary_test(parser, eval_size);
 	if (!expr) {
 		return NULL;
 	}
 
-	const char *unit = parse_icmp(state, expr, IF_PARTIAL_OK);
+	const char *unit = parse_icmp(parser, expr, IF_PARTIAL_OK);
 	if (!unit) {
-		goto fail;
+		return NULL;
 	}
 
 	if (strlen(unit) > 1) {
@@ -2632,109 +2420,82 @@ static struct bfs_expr *parse_size(struct parser_state *state, int arg1, int arg
 		break;
 
 	default:
-		goto bad_unit;
+	bad_unit:
+		parse_expr_error(parser, expr, "Expected a size unit (one of ${bld}cwbkMGTP${rs}); found ${err}%pq${rs}.\n", unit);
+		return NULL;
 	}
 
-	expr->cost = STAT_COST;
-	expr->probability = expr->int_cmp == BFS_INT_EQUAL ? 0.01 : 0.50;
-
 	return expr;
-
-bad_unit:
-	parse_expr_error(state, expr, "Expected a size unit (one of ${bld}cwbkMGTP${rs}); found ${err}%s${rs}.\n", unit);
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -sparse.
  */
-static struct bfs_expr *parse_sparse(struct parser_state *state, int arg1, int arg2) {
-	struct bfs_expr *expr = parse_nullary_test(state, eval_sparse);
-	if (expr) {
-		expr->cost = STAT_COST;
-	}
-	return expr;
+static struct bfs_expr *parse_sparse(struct bfs_parser *parser, int arg1, int arg2) {
+	return parse_nullary_test(parser, eval_sparse);
 }
 
 /**
  * Parse -status.
  */
-static struct bfs_expr *parse_status(struct parser_state *state, int arg1, int arg2) {
-	state->ctx->status = true;
-	return parse_nullary_option(state);
+static struct bfs_expr *parse_status(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->ctx->status = true;
+	return parse_nullary_option(parser);
 }
 
 /**
  * Parse -x?type [bcdpflsD].
  */
-static struct bfs_expr *parse_type(struct parser_state *state, int x, int arg2) {
+static struct bfs_expr *parse_type(struct bfs_parser *parser, int x, int arg2) {
+	struct bfs_ctx *ctx = parser->ctx;
+
 	bfs_eval_fn *eval = x ? eval_xtype : eval_type;
-	struct bfs_expr *expr = parse_unary_test(state, eval);
+	struct bfs_expr *expr = parse_unary_test(parser, eval);
 	if (!expr) {
 		return NULL;
 	}
 
-	unsigned int types = 0;
-	float probability = 0.0;
+	expr->num = 0;
 
 	const char *c = expr->argv[1];
 	while (true) {
-		enum bfs_type type;
-		float type_prob;
-
 		switch (*c) {
 		case 'b':
-			type = BFS_BLK;
-			type_prob = 0.00000721183;
+			expr->num |= 1 << BFS_BLK;
 			break;
 		case 'c':
-			type = BFS_CHR;
-			type_prob = 0.0000499855;
+			expr->num |= 1 << BFS_CHR;
 			break;
 		case 'd':
-			type = BFS_DIR;
-			type_prob = 0.114475;
+			expr->num |= 1 << BFS_DIR;
 			break;
 		case 'D':
-			type = BFS_DOOR;
-			type_prob = 0.000001;
+			expr->num |= 1 << BFS_DOOR;
 			break;
 		case 'p':
-			type = BFS_FIFO;
-			type_prob = 0.00000248684;
+			expr->num |= 1 << BFS_FIFO;
 			break;
 		case 'f':
-			type = BFS_REG;
-			type_prob = 0.859772;
+			expr->num |= 1 << BFS_REG;
 			break;
 		case 'l':
-			type = BFS_LNK;
-			type_prob = 0.0256816;
+			expr->num |= 1 << BFS_LNK;
 			break;
 		case 's':
-			type = BFS_SOCK;
-			type_prob = 0.0000116881;
+			expr->num |= 1 << BFS_SOCK;
 			break;
 		case 'w':
-			type = BFS_WHT;
-			type_prob = 0.000001;
+			expr->num |= 1 << BFS_WHT;
+			ctx->flags |= BFTW_WHITEOUTS;
 			break;
 
 		case '\0':
-			parse_expr_error(state, expr, "Expected a type flag.\n");
-			goto fail;
+			parse_expr_error(parser, expr, "Expected a type flag.\n");
+			return NULL;
 
 		default:
-			parse_expr_error(state, expr, "Unknown type flag ${err}%c${rs}; expected one of [${bld}bcdpflsD${rs}].\n", *c);
-			goto fail;
-		}
-
-		unsigned int flag = 1 << type;
-		if (!(types & flag)) {
-			types |= flag;
-			probability += type_prob;
+			parse_expr_error(parser, expr, "Unknown type flag ${err}%c${rs}; expected one of [${bld}bcdpflsD${rs}].\n", *c);
+			return NULL;
 		}
 
 		++c;
@@ -2744,49 +2505,30 @@ static struct bfs_expr *parse_type(struct parser_state *state, int x, int arg2)
 			++c;
 			continue;
 		} else {
-			parse_expr_error(state, expr, "Types must be comma-separated.\n");
-			goto fail;
+			parse_expr_error(parser, expr, "Types must be comma-separated.\n");
+			return NULL;
 		}
 	}
 
-	expr->num = types;
-	expr->probability = probability;
-
-	if (x && state->ctx->optlevel < 4) {
-		// Since -xtype dereferences symbolic links, it may have side
-		// effects such as reporting permission errors, and thus
-		// shouldn't be re-ordered without aggressive optimizations
-		expr->pure = false;
-	}
-
 	return expr;
-
-fail:
-	bfs_expr_free(expr);
-	return NULL;
 }
 
 /**
  * Parse -(no)?warn.
  */
-static struct bfs_expr *parse_warn(struct parser_state *state, int warn, int arg2) {
-	state->ctx->warn = warn;
-	return parse_nullary_option(state);
+static struct bfs_expr *parse_warn(struct bfs_parser *parser, int warn, int arg2) {
+	parser->ctx->warn = warn;
+	return parse_nullary_option(parser);
 }
 
 /**
  * Parse -xattr.
  */
-static struct bfs_expr *parse_xattr(struct parser_state *state, int arg1, int arg2) {
+static struct bfs_expr *parse_xattr(struct bfs_parser *parser, int arg1, int arg2) {
 #if BFS_CAN_CHECK_XATTRS
-	struct bfs_expr *expr = parse_nullary_test(state, eval_xattr);
-	if (expr) {
-		expr->cost = STAT_COST;
-		expr->probability = 0.01;
-	}
-	return expr;
+	return parse_nullary_test(parser, eval_xattr);
 #else
-	parse_error(state, "Missing platform support.\n");
+	parse_error(parser, "Missing platform support.\n");
 	return NULL;
 #endif
 }
@@ -2794,16 +2536,11 @@ static struct bfs_expr *parse_xattr(struct parser_state *state, int arg1, int ar
 /**
  * Parse -xattrname.
  */
-static struct bfs_expr *parse_xattrname(struct parser_state *state, int arg1, int arg2) {
+static struct bfs_expr *parse_xattrname(struct bfs_parser *parser, int arg1, int arg2) {
 #if BFS_CAN_CHECK_XATTRS
-	struct bfs_expr *expr = parse_unary_test(state, eval_xattrname);
-	if (expr) {
-		expr->cost = STAT_COST;
-		expr->probability = 0.01;
-	}
-	return expr;
+	return parse_unary_test(parser, eval_xattrname);
 #else
-	parse_error(state, "Missing platform support.\n");
+	parse_error(parser, "Missing platform support.\n");
 	return NULL;
 #endif
 }
@@ -2811,10 +2548,10 @@ static struct bfs_expr *parse_xattrname(struct parser_state *state, int arg1, in
 /**
  * Parse -xdev.
  */
-static struct bfs_expr *parse_xdev(struct parser_state *state, int arg1, int arg2) {
-	state->ctx->flags |= BFTW_PRUNE_MOUNTS;
-	state->xdev_arg = state->argv;
-	return parse_nullary_option(state);
+static struct bfs_expr *parse_xdev(struct bfs_parser *parser, int arg1, int arg2) {
+	parser->ctx->flags |= BFTW_PRUNE_MOUNTS;
+	parser->xdev_arg = parser->argv;
+	return parse_nullary_option(parser);
 }
 
 /**
@@ -2874,7 +2611,8 @@ static CFILE *launch_pager(pid_t *pid, CFILE *cout) {
 		NULL,
 	};
 
-	if (strcmp(xbasename(exe), "less") == 0) {
+	const char *cmd = exe + xbaseoff(exe);
+	if (strcmp(cmd, "less") == 0) {
 		// We know less supports colors, other pagers may not
 		ret->colors = cout->colors;
 		argv[1] = "-FKRX";
@@ -2914,21 +2652,21 @@ fail:
 /**
  * "Parse" -help.
  */
-static struct bfs_expr *parse_help(struct parser_state *state, int arg1, int arg2) {
-	CFILE *cout = state->ctx->cout;
+static struct bfs_expr *parse_help(struct bfs_parser *parser, int arg1, int arg2) {
+	CFILE *cout = parser->ctx->cout;
 
 	pid_t pager = -1;
-	if (state->stdout_tty) {
+	if (parser->stdout_tty) {
 		cout = launch_pager(&pager, cout);
 	}
 
 	cfprintf(cout, "Usage: ${ex}%s${rs} [${cyn}flags${rs}...] [${mag}paths${rs}...] [${blu}expression${rs}...]\n\n",
-		 state->command);
+		parser->command);
 
 	cfprintf(cout, "${ex}%s${rs} is compatible with ${ex}find${rs}, with some extensions. "
-		       "${cyn}Flags${rs} (${cyn}-H${rs}/${cyn}-L${rs}/${cyn}-P${rs} etc.), ${mag}paths${rs},\n"
-		       "and ${blu}expressions${rs} may be freely mixed in any order.\n\n",
-		 BFS_COMMAND);
+	               "${cyn}Flags${rs} (${cyn}-H${rs}/${cyn}-L${rs}/${cyn}-P${rs} etc.), ${mag}paths${rs},\n"
+	               "and ${blu}expressions${rs} may be freely mixed in any order.\n\n",
+		BFS_COMMAND);
 
 	cfprintf(cout, "${bld}Flags:${rs}\n\n");
 
@@ -2958,7 +2696,9 @@ static struct bfs_expr *parse_help(struct parser_state *state, int arg1, int arg
 	cfprintf(cout, "      Enable optimization level ${bld}N${rs} (default: ${bld}3${rs})\n");
 	cfprintf(cout, "  ${cyn}-S${rs} ${bld}bfs${rs}|${bld}dfs${rs}|${bld}ids${rs}|${bld}eds${rs}\n");
 	cfprintf(cout, "      Use ${bld}b${rs}readth-${bld}f${rs}irst/${bld}d${rs}epth-${bld}f${rs}irst/${bld}i${rs}terative/${bld}e${rs}xponential ${bld}d${rs}eepening ${bld}s${rs}earch\n");
-	cfprintf(cout, "      (default: ${cyn}-S${rs} ${bld}bfs${rs})\n\n");
+	cfprintf(cout, "      (default: ${cyn}-S${rs} ${bld}bfs${rs})\n");
+	cfprintf(cout, "  ${cyn}-j${bld}N${rs}\n");
+	cfprintf(cout, "      Search with ${bld}N${rs} threads in parallel (default: number of CPUs, up to ${bld}8${rs})\n\n");
 
 	cfprintf(cout, "${bld}Operators:${rs}\n\n");
 
@@ -2998,7 +2738,7 @@ static struct bfs_expr *parse_help(struct parser_state *state, int arg1, int arg
 	cfprintf(cout, "  ${blu}-ignore_readdir_race${rs}\n");
 	cfprintf(cout, "  ${blu}-noignore_readdir_race${rs}\n");
 	cfprintf(cout, "      Whether to report an error if ${ex}%s${rs} detects that the file tree is modified\n",
-	         BFS_COMMAND);
+		BFS_COMMAND);
 	cfprintf(cout, "      during the search (default: ${blu}-noignore_readdir_race${rs})\n");
 	cfprintf(cout, "  ${blu}-maxdepth${rs} ${bld}N${rs}\n");
 	cfprintf(cout, "  ${blu}-mindepth${rs} ${bld}N${rs}\n");
@@ -3041,6 +2781,10 @@ static struct bfs_expr *parse_help(struct parser_state *state, int arg1, int arg
 	cfprintf(cout, "  ${blu}-capable${rs}\n");
 	cfprintf(cout, "      Find files with POSIX.1e capabilities set\n");
 #endif
+#if BFS_CAN_CHECK_CONTEXT
+	cfprintf(cout, "  ${blu}-context${rs} ${bld}GLOB${rs}\n");
+	cfprintf(cout, "      Find files with SELinux context matching a glob pattern\n");
+#endif
 	cfprintf(cout, "  ${blu}-depth${rs} ${bld}[-+]N${rs}\n");
 	cfprintf(cout, "      Find files with depth ${bld}N${rs}\n");
 	cfprintf(cout, "  ${blu}-empty${rs}\n");
@@ -3143,6 +2887,8 @@ static struct bfs_expr *parse_help(struct parser_state *state, int arg1, int arg
 	cfprintf(cout, "  ${blu}-fprintf${rs} ${bld}FILE${rs} ${bld}FORMAT${rs}\n");
 	cfprintf(cout, "      Like ${blu}-ls${rs}/${blu}-print${rs}/${blu}-print0${rs}/${blu}-printf${rs}, but write to ${bld}FILE${rs} instead of standard\n"
 	               "      output\n");
+	cfprintf(cout, "  ${blu}-limit${rs} ${bld}N${rs}\n");
+	cfprintf(cout, "      Quit after this action is evaluated ${bld}N${rs} times\n");
 	cfprintf(cout, "  ${blu}-ls${rs}\n");
 	cfprintf(cout, "      List files like ${ex}ls${rs} ${bld}-dils${rs}\n");
 	cfprintf(cout, "  ${blu}-print${rs}\n");
@@ -3169,26 +2915,26 @@ static struct bfs_expr *parse_help(struct parser_state *state, int arg1, int arg
 
 	if (pager > 0) {
 		cfclose(cout);
-		waitpid(pager, NULL, 0);
+		xwaitpid(pager, NULL, 0);
 	}
 
-	state->just_info = true;
+	parser->just_info = true;
 	return NULL;
 }
 
 /**
  * "Parse" -version.
  */
-static struct bfs_expr *parse_version(struct parser_state *state, int arg1, int arg2) {
-	cfprintf(state->ctx->cout, "${ex}%s${rs} ${bld}%s${rs}\n\n", BFS_COMMAND, BFS_VERSION);
+static struct bfs_expr *parse_version(struct bfs_parser *parser, int arg1, int arg2) {
+	cfprintf(parser->ctx->cout, "${ex}%s${rs} ${bld}%s${rs}\n\n", BFS_COMMAND, bfs_version);
 
 	printf("%s\n", BFS_HOMEPAGE);
 
-	state->just_info = true;
+	parser->just_info = true;
 	return NULL;
 }
 
-typedef struct bfs_expr *parse_fn(struct parser_state *state, int arg1, int arg2);
+typedef struct bfs_expr *parse_fn(struct bfs_parser *parser, int arg1, int arg2);
 
 /**
  * An entry in the parse table for primary expressions.
@@ -3232,6 +2978,7 @@ static const struct table_entry parse_table[] = {
 	{"-cmin", T_TEST, parse_min, BFS_STAT_CTIME},
 	{"-cnewer", T_TEST, parse_newer, BFS_STAT_CTIME},
 	{"-color", T_OPTION, parse_color, true},
+	{"-context", T_TEST, parse_context, true},
 	{"-csince", T_TEST, parse_since, BFS_STAT_CTIME},
 	{"-ctime", T_TEST, parse_time, BFS_STAT_CTIME},
 	{"-d", T_FLAG, parse_depth},
@@ -3265,6 +3012,8 @@ static const struct table_entry parse_table[] = {
 	{"-ipath", T_TEST, parse_path, true},
 	{"-iregex", T_TEST, parse_regex, BFS_REGEX_ICASE},
 	{"-iwholename", T_TEST, parse_path, true},
+	{"-j", T_FLAG, parse_jobs, 0, 0, true},
+	{"-limit", T_ACTION, parse_limit},
 	{"-links", T_TEST, parse_links},
 	{"-lname", T_TEST, parse_lname, false},
 	{"-ls", T_ACTION, parse_ls},
@@ -3364,9 +3113,9 @@ static const struct table_entry *table_lookup_fuzzy(const char *arg) {
  *         | TEST
  *         | ACTION
  */
-static struct bfs_expr *parse_primary(struct parser_state *state) {
+static struct bfs_expr *parse_primary(struct bfs_parser *parser) {
 	// Paths are already skipped at this point
-	const char *arg = state->argv[0];
+	const char *arg = parser->argv[0];
 
 	if (arg[0] != '-') {
 		goto unexpected;
@@ -3383,8 +3132,8 @@ static struct bfs_expr *parse_primary(struct parser_state *state) {
 
 	match = table_lookup_fuzzy(arg);
 
-	CFILE *cerr = state->ctx->cerr;
-	parse_error(state, "Unknown argument; did you mean ");
+	CFILE *cerr = parser->ctx->cerr;
+	parse_error(parser, "Unknown argument; did you mean ");
 	switch (match->type) {
 	case T_FLAG:
 		cfprintf(cerr, "${cyn}%s${rs}?", match->arg);
@@ -3397,7 +3146,7 @@ static struct bfs_expr *parse_primary(struct parser_state *state) {
 		break;
 	}
 
-	if (!state->interactive || !match->parse) {
+	if (!parser->interactive || !match->parse) {
 		fprintf(stderr, "\n");
 		goto unmatched;
 	}
@@ -3408,16 +3157,16 @@ static struct bfs_expr *parse_primary(struct parser_state *state) {
 	}
 
 	fprintf(stderr, "\n");
-	state->argv[0] = match->arg;
+	parser->argv[0] = match->arg;
 
 matched:
-	return match->parse(state, match->arg1, match->arg2);
+	return match->parse(parser, match->arg1, match->arg2);
 
 unmatched:
 	return NULL;
 
 unexpected:
-	parse_error(state, "Expected a predicate.\n");
+	parse_error(parser, "Expected a predicate.\n");
 	return NULL;
 }
 
@@ -3427,71 +3176,66 @@ unexpected:
  *        | "-exclude" FACTOR
  *        | PRIMARY
  */
-static struct bfs_expr *parse_factor(struct parser_state *state) {
-	if (skip_paths(state) != 0) {
+static struct bfs_expr *parse_factor(struct bfs_parser *parser) {
+	if (skip_paths(parser) != 0) {
 		return NULL;
 	}
 
-	const char *arg = state->argv[0];
+	const char *arg = parser->argv[0];
 	if (!arg) {
-		parse_argv_error(state, state->last_arg, 1, "Expression terminated prematurely here.\n");
+		parse_argv_error(parser, parser->last_arg, 1, "Expression terminated prematurely here.\n");
 		return NULL;
 	}
 
 	if (strcmp(arg, "(") == 0) {
-		parser_advance(state, T_OPERATOR, 1);
+		parser_advance(parser, T_OPERATOR, 1);
 
-		struct bfs_expr *expr = parse_expr(state);
+		struct bfs_expr *expr = parse_expr(parser);
 		if (!expr) {
 			return NULL;
 		}
 
-		if (skip_paths(state) != 0) {
-			bfs_expr_free(expr);
+		if (skip_paths(parser) != 0) {
 			return NULL;
 		}
 
-		arg = state->argv[0];
+		arg = parser->argv[0];
 		if (!arg || strcmp(arg, ")") != 0) {
-			parse_argv_error(state, state->last_arg, 1, "Expected a ${red})${rs}.\n");
-			bfs_expr_free(expr);
+			parse_argv_error(parser, parser->last_arg, 1, "Expected a ${red})${rs}.\n");
 			return NULL;
 		}
 
-		parser_advance(state, T_OPERATOR, 1);
+		parser_advance(parser, T_OPERATOR, 1);
 		return expr;
 	} else if (strcmp(arg, "-exclude") == 0) {
-		if (state->excluding) {
-			parse_error(state, "${err}%s${rs} is not supported within ${red}-exclude${rs}.\n", arg);
+		if (parser->excluding) {
+			parse_error(parser, "${err}%s${rs} is not supported within ${red}-exclude${rs}.\n", arg);
 			return NULL;
 		}
 
-		parser_advance(state, T_OPERATOR, 1);
-		state->excluding = true;
+		char **argv = parser_advance(parser, T_OPERATOR, 1);
+		parser->excluding = true;
 
-		struct bfs_expr *factor = parse_factor(state);
+		struct bfs_expr *factor = parse_factor(parser);
 		if (!factor) {
 			return NULL;
 		}
 
-		state->excluding = false;
-
-		if (parse_exclude(state, factor) != 0) {
-			return NULL;
-		}
+		parser->excluding = false;
 
-		return &bfs_true;
+		bfs_expr_append(parser->ctx->exclude, factor);
+		return parse_new_expr(parser, eval_true, parser->argv - argv, argv);
 	} else if (strcmp(arg, "!") == 0 || strcmp(arg, "-not") == 0) {
-		char **argv = parser_advance(state, T_OPERATOR, 1);
+		char **argv = parser_advance(parser, T_OPERATOR, 1);
 
-		struct bfs_expr *factor = parse_factor(state);
+		struct bfs_expr *factor = parse_factor(parser);
 		if (!factor) {
 			return NULL;
 		}
 
-		return new_unary_expr(eval_not, factor, argv);
+		return new_unary_expr(parser, eval_not, factor, argv);
 	} else {
-		return parse_primary(state);
+		return parse_primary(parser);
 	}
 }
 
@@ -3501,16 +3245,15 @@ static struct bfs_expr *parse_factor(struct parser_state *state) {
  *      | TERM "-a" FACTOR
  *      | TERM "-and" FACTOR
  */
-static struct bfs_expr *parse_term(struct parser_state *state) {
-	struct bfs_expr *term = parse_factor(state);
+static struct bfs_expr *parse_term(struct bfs_parser *parser) {
+	struct bfs_expr *term = parse_factor(parser);
 
 	while (term) {
-		if (skip_paths(state) != 0) {
-			bfs_expr_free(term);
+		if (skip_paths(parser) != 0) {
 			return NULL;
 		}
 
-		const char *arg = state->argv[0];
+		const char *arg = parser->argv[0];
 		if (!arg) {
 			break;
 		}
@@ -3523,17 +3266,16 @@ static struct bfs_expr *parse_term(struct parser_state *state) {
 
 		char **argv = &fake_and_arg;
 		if (strcmp(arg, "-a") == 0 || strcmp(arg, "-and") == 0) {
-			argv = parser_advance(state, T_OPERATOR, 1);
+			argv = parser_advance(parser, T_OPERATOR, 1);
 		}
 
 		struct bfs_expr *lhs = term;
-		struct bfs_expr *rhs = parse_factor(state);
+		struct bfs_expr *rhs = parse_factor(parser);
 		if (!rhs) {
-			bfs_expr_free(lhs);
 			return NULL;
 		}
 
-		term = new_binary_expr(eval_and, lhs, rhs, argv);
+		term = new_binary_expr(parser, eval_and, lhs, rhs, argv);
 	}
 
 	return term;
@@ -3544,16 +3286,15 @@ static struct bfs_expr *parse_term(struct parser_state *state) {
  *        | CLAUSE "-o" TERM
  *        | CLAUSE "-or" TERM
  */
-static struct bfs_expr *parse_clause(struct parser_state *state) {
-	struct bfs_expr *clause = parse_term(state);
+static struct bfs_expr *parse_clause(struct bfs_parser *parser) {
+	struct bfs_expr *clause = parse_term(parser);
 
 	while (clause) {
-		if (skip_paths(state) != 0) {
-			bfs_expr_free(clause);
+		if (skip_paths(parser) != 0) {
 			return NULL;
 		}
 
-		const char *arg = state->argv[0];
+		const char *arg = parser->argv[0];
 		if (!arg) {
 			break;
 		}
@@ -3562,16 +3303,15 @@ static struct bfs_expr *parse_clause(struct parser_state *state) {
 			break;
 		}
 
-		char **argv = parser_advance(state, T_OPERATOR, 1);
+		char **argv = parser_advance(parser, T_OPERATOR, 1);
 
 		struct bfs_expr *lhs = clause;
-		struct bfs_expr *rhs = parse_term(state);
+		struct bfs_expr *rhs = parse_term(parser);
 		if (!rhs) {
-			bfs_expr_free(lhs);
 			return NULL;
 		}
 
-		clause = new_binary_expr(eval_or, lhs, rhs, argv);
+		clause = new_binary_expr(parser, eval_or, lhs, rhs, argv);
 	}
 
 	return clause;
@@ -3581,16 +3321,15 @@ static struct bfs_expr *parse_clause(struct parser_state *state) {
  * EXPR : CLAUSE
  *      | EXPR "," CLAUSE
  */
-static struct bfs_expr *parse_expr(struct parser_state *state) {
-	struct bfs_expr *expr = parse_clause(state);
+static struct bfs_expr *parse_expr(struct bfs_parser *parser) {
+	struct bfs_expr *expr = parse_clause(parser);
 
 	while (expr) {
-		if (skip_paths(state) != 0) {
-			bfs_expr_free(expr);
+		if (skip_paths(parser) != 0) {
 			return NULL;
 		}
 
-		const char *arg = state->argv[0];
+		const char *arg = parser->argv[0];
 		if (!arg) {
 			break;
 		}
@@ -3599,16 +3338,15 @@ static struct bfs_expr *parse_expr(struct parser_state *state) {
 			break;
 		}
 
-		char **argv = parser_advance(state, T_OPERATOR, 1);
+		char **argv = parser_advance(parser, T_OPERATOR, 1);
 
 		struct bfs_expr *lhs = expr;
-		struct bfs_expr *rhs = parse_clause(state);
+		struct bfs_expr *rhs = parse_clause(parser);
 		if (!rhs) {
-			bfs_expr_free(lhs);
 			return NULL;
 		}
 
-		expr = new_binary_expr(eval_comma, lhs, rhs, argv);
+		expr = new_binary_expr(parser, eval_comma, lhs, rhs, argv);
 	}
 
 	return expr;
@@ -3617,71 +3355,129 @@ static struct bfs_expr *parse_expr(struct parser_state *state) {
 /**
  * Parse the top-level expression.
  */
-static struct bfs_expr *parse_whole_expr(struct parser_state *state) {
-	if (skip_paths(state) != 0) {
+static struct bfs_expr *parse_whole_expr(struct bfs_parser *parser) {
+	if (skip_paths(parser) != 0) {
 		return NULL;
 	}
 
-	struct bfs_expr *expr = &bfs_true;
-	if (state->argv[0]) {
-		expr = parse_expr(state);
-		if (!expr) {
-			return NULL;
-		}
+	struct bfs_expr *expr;
+	if (parser->argv[0]) {
+		expr = parse_expr(parser);
+	} else {
+		expr = parse_new_expr(parser, eval_true, 1, &fake_true_arg);
+	}
+	if (!expr) {
+		return NULL;
 	}
 
-	if (state->argv[0]) {
-		parse_error(state, "Unexpected argument.\n");
-		goto fail;
+	if (parser->argv[0]) {
+		parse_error(parser, "Unexpected argument.\n");
+		return NULL;
 	}
 
-	if (state->implicit_print) {
-		struct bfs_expr *print = bfs_expr_new(eval_fprint, 1, &fake_print_arg);
+	if (parser->implicit_print) {
+		char **limit = parser->limit_arg;
+		if (limit) {
+			parse_argv_error(parser, parser->limit_arg, 2,
+				"With ${blu}%s${rs}, you must specify an action explicitly; for example, ${blu}-print${rs} ${blu}%s${rs} ${bld}%s${rs}.\n",
+				limit[0], limit[0], limit[1]);
+			return NULL;
+		}
+
+		struct bfs_expr *print = parse_new_expr(parser, eval_fprint, 1, &fake_print_arg);
 		if (!print) {
-			goto fail;
+			return NULL;
 		}
-		init_print_expr(state, print);
-		print->synthetic = true;
+		init_print_expr(parser, print);
 
-		expr = new_binary_expr(eval_and, expr, print, &fake_and_arg);
+		expr = new_binary_expr(parser, eval_and, expr, print, &fake_and_arg);
 		if (!expr) {
-			goto fail;
+			return NULL;
 		}
 	}
 
-	if (state->mount_arg && state->xdev_arg) {
-		parse_conflict_warning(state, state->mount_arg, 1, state->xdev_arg, 1,
-		                       "${blu}%s${rs} is redundant in the presence of ${blu}%s${rs}.\n\n",
-		                       state->xdev_arg[0], state->mount_arg[0]);
+	if (parser->mount_arg && parser->xdev_arg) {
+		parse_conflict_warning(parser, parser->mount_arg, 1, parser->xdev_arg, 1,
+			"${blu}%s${rs} is redundant in the presence of ${blu}%s${rs}.\n\n",
+			parser->xdev_arg[0], parser->mount_arg[0]);
 	}
 
-	if (state->ctx->warn && state->depth_arg && state->prune_arg) {
-		parse_conflict_warning(state, state->depth_arg, 1, state->prune_arg, 1,
-		                       "${blu}%s${rs} does not work in the presence of ${blu}%s${rs}.\n",
-		                       state->prune_arg[0], state->depth_arg[0]);
+	if (parser->ctx->warn && parser->depth_arg && parser->prune_arg) {
+		parse_conflict_warning(parser, parser->depth_arg, 1, parser->prune_arg, 1,
+			"${blu}%s${rs} does not work in the presence of ${blu}%s${rs}.\n",
+			parser->prune_arg[0], parser->depth_arg[0]);
 
-		if (state->interactive) {
-			bfs_warning(state->ctx, "Do you want to continue? ");
+		if (parser->interactive) {
+			bfs_warning(parser->ctx, "Do you want to continue? ");
 			if (ynprompt() == 0) {
-				goto fail;
+				return NULL;
 			}
 		}
 
 		fprintf(stderr, "\n");
 	}
 
-	if (state->ok_expr && state->files0_stdin_arg) {
-		parse_conflict_error(state, state->ok_expr->argv, state->ok_expr->argc, state->files0_stdin_arg, 2,
-		                     "${blu}%s${rs} conflicts with ${blu}%s${rs} ${bld}%s${rs}.\n",
-		                     state->ok_expr->argv[0], state->files0_stdin_arg[0], state->files0_stdin_arg[1]);
-		goto fail;
+	if (parser->ok_expr && parser->files0_stdin_arg) {
+		parse_conflict_error(parser, parser->ok_expr->argv, parser->ok_expr->argc, parser->files0_stdin_arg, 2,
+			"${blu}%s${rs} conflicts with ${blu}%s${rs} ${bld}%s${rs}.\n",
+			parser->ok_expr->argv[0], parser->files0_stdin_arg[0], parser->files0_stdin_arg[1]);
+		return NULL;
 	}
 
 	return expr;
+}
 
-fail:
-	bfs_expr_free(expr);
-	return NULL;
+static const char *bftw_strategy_name(enum bftw_strategy strategy) {
+	switch (strategy) {
+	case BFTW_BFS:
+		return "bfs";
+	case BFTW_DFS:
+		return "dfs";
+	case BFTW_IDS:
+		return "ids";
+	case BFTW_EDS:
+		return "eds";
+	}
+
+	bfs_bug("Invalid strategy");
+	return "???";
+}
+
+static void dump_expr_multiline(const struct bfs_ctx *ctx, enum debug_flags flag, const struct bfs_expr *expr, int indent, int rparens) {
+	bfs_debug_prefix(ctx, flag);
+
+	for (int i = 0; i < indent; ++i) {
+		cfprintf(ctx->cerr, "  ");
+	}
+
+	bool close = true;
+
+	if (bfs_expr_is_parent(expr)) {
+		if (SLIST_EMPTY(&expr->children)) {
+			cfprintf(ctx->cerr, "(${red}%s${rs}", expr->argv[0]);
+			++rparens;
+		} else {
+			cfprintf(ctx->cerr, "(${red}%s${rs}\n", expr->argv[0]);
+			for (struct bfs_expr *child = bfs_expr_children(expr); child; child = child->next) {
+				int parens = child->next ? 0 : rparens + 1;
+				dump_expr_multiline(ctx, flag, child, indent + 1, parens);
+			}
+			close = false;
+		}
+	} else {
+		if (flag == DEBUG_RATES) {
+			cfprintf(ctx->cerr, "%pE", expr);
+		} else {
+			cfprintf(ctx->cerr, "%pe", expr);
+		}
+	}
+
+	if (close) {
+		for (int i = 0; i < rparens; ++i) {
+			cfprintf(ctx->cerr, ")");
+		}
+		cfprintf(ctx->cerr, "\n");
+	}
 }
 
 void bfs_ctx_dump(const struct bfs_ctx *ctx, enum debug_flags flag) {
@@ -3691,51 +3487,37 @@ void bfs_ctx_dump(const struct bfs_ctx *ctx, enum debug_flags flag) {
 
 	CFILE *cerr = ctx->cerr;
 
-	cfprintf(cerr, "${ex}%s${rs} ", ctx->argv[0]);
+	cfprintf(cerr, "${ex}%s${rs}", ctx->argv[0]);
 
 	if (ctx->flags & BFTW_FOLLOW_ALL) {
-		cfprintf(cerr, "${cyn}-L${rs} ");
+		cfprintf(cerr, " ${cyn}-L${rs}");
 	} else if (ctx->flags & BFTW_FOLLOW_ROOTS) {
-		cfprintf(cerr, "${cyn}-H${rs} ");
+		cfprintf(cerr, " ${cyn}-H${rs}");
 	} else {
-		cfprintf(cerr, "${cyn}-P${rs} ");
+		cfprintf(cerr, " ${cyn}-P${rs}");
 	}
 
 	if (ctx->xargs_safe) {
-		cfprintf(cerr, "${cyn}-X${rs} ");
+		cfprintf(cerr, " ${cyn}-X${rs}");
 	}
 
 	if (ctx->flags & BFTW_SORT) {
-		cfprintf(cerr, "${cyn}-s${rs} ");
+		cfprintf(cerr, " ${cyn}-s${rs}");
 	}
 
+	cfprintf(cerr, " ${cyn}-j${bld}%d${rs}", ctx->threads);
+
 	if (ctx->optlevel != 3) {
-		cfprintf(cerr, "${cyn}-O${bld}%d${rs} ", ctx->optlevel);
+		cfprintf(cerr, " ${cyn}-O${bld}%d${rs}", ctx->optlevel);
 	}
 
-	const char *strategy = NULL;
-	switch (ctx->strategy) {
-	case BFTW_BFS:
-		strategy = "bfs";
-		break;
-	case BFTW_DFS:
-		strategy = "dfs";
-		break;
-	case BFTW_IDS:
-		strategy = "ids";
-		break;
-	case BFTW_EDS:
-		strategy = "eds";
-		break;
-	}
-	assert(strategy);
-	cfprintf(cerr, "${cyn}-S${rs} ${bld}%s${rs} ", strategy);
+	cfprintf(cerr, " ${cyn}-S${rs} ${bld}%s${rs}", bftw_strategy_name(ctx->strategy));
 
 	enum debug_flags debug = ctx->debug;
 	if (debug == DEBUG_ALL) {
-		cfprintf(cerr, "${cyn}-D${rs} ${bld}all${rs} ");
+		cfprintf(cerr, " ${cyn}-D${rs} ${bld}all${rs}");
 	} else if (debug) {
-		cfprintf(cerr, "${cyn}-D${rs} ");
+		cfprintf(cerr, " ${cyn}-D${rs} ");
 		for (enum debug_flags i = 1; DEBUG_ALL & i; i <<= 1) {
 			if (debug & i) {
 				cfprintf(cerr, "${bld}%s${rs}", debug_flag_name(i));
@@ -3745,61 +3527,53 @@ void bfs_ctx_dump(const struct bfs_ctx *ctx, enum debug_flags flag) {
 				}
 			}
 		}
-		cfprintf(cerr, " ");
 	}
 
-	for (size_t i = 0; i < darray_length(ctx->paths); ++i) {
+	for (size_t i = 0; i < ctx->npaths; ++i) {
 		const char *path = ctx->paths[i];
 		char c = path[0];
 		if (c == '-' || c == '(' || c == ')' || c == '!' || c == ',') {
-			cfprintf(cerr, "${cyn}-f${rs} ");
+			cfprintf(cerr, " ${cyn}-f${rs}");
 		}
-		cfprintf(cerr, "${mag}%s${rs} ", path);
+		cfprintf(cerr, " ${mag}%pq${rs}", path);
 	}
 
 	if (ctx->cout->colors) {
-		cfprintf(cerr, "${blu}-color${rs} ");
+		cfprintf(cerr, " ${blu}-color${rs}");
 	} else {
-		cfprintf(cerr, "${blu}-nocolor${rs} ");
+		cfprintf(cerr, " ${blu}-nocolor${rs}");
 	}
 	if (ctx->flags & BFTW_POST_ORDER) {
-		cfprintf(cerr, "${blu}-depth${rs} ");
+		cfprintf(cerr, " ${blu}-depth${rs}");
 	}
 	if (ctx->ignore_races) {
-		cfprintf(cerr, "${blu}-ignore_readdir_race${rs} ");
+		cfprintf(cerr, " ${blu}-ignore_readdir_race${rs}");
 	}
 	if (ctx->mindepth != 0) {
-		cfprintf(cerr, "${blu}-mindepth${rs} ${bld}%d${rs} ", ctx->mindepth);
+		cfprintf(cerr, " ${blu}-mindepth${rs} ${bld}%d${rs}", ctx->mindepth);
 	}
 	if (ctx->maxdepth != INT_MAX) {
-		cfprintf(cerr, "${blu}-maxdepth${rs} ${bld}%d${rs} ", ctx->maxdepth);
+		cfprintf(cerr, " ${blu}-maxdepth${rs} ${bld}%d${rs}", ctx->maxdepth);
 	}
 	if (ctx->flags & BFTW_SKIP_MOUNTS) {
-		cfprintf(cerr, "${blu}-mount${rs} ");
+		cfprintf(cerr, " ${blu}-mount${rs}");
 	}
 	if (ctx->status) {
-		cfprintf(cerr, "${blu}-status${rs} ");
+		cfprintf(cerr, " ${blu}-status${rs}");
 	}
 	if (ctx->unique) {
-		cfprintf(cerr, "${blu}-unique${rs} ");
+		cfprintf(cerr, " ${blu}-unique${rs}");
 	}
 	if ((ctx->flags & (BFTW_SKIP_MOUNTS | BFTW_PRUNE_MOUNTS)) == BFTW_PRUNE_MOUNTS) {
-		cfprintf(cerr, "${blu}-xdev${rs} ");
-	}
-
-	if (flag == DEBUG_RATES) {
-		if (ctx->exclude != &bfs_false) {
-			cfprintf(cerr, "(${red}-exclude${rs} %pE) ", ctx->exclude);
-		}
-		cfprintf(cerr, "%pE", ctx->expr);
-	} else {
-		if (ctx->exclude != &bfs_false) {
-			cfprintf(cerr, "(${red}-exclude${rs} %pe) ", ctx->exclude);
-		}
-		cfprintf(cerr, "%pe", ctx->expr);
+		cfprintf(cerr, " ${blu}-xdev${rs}");
 	}
 
 	fputs("\n", stderr);
+
+	bfs_debug(ctx, flag, "(${red}-exclude${rs}\n");
+	dump_expr_multiline(ctx, flag, ctx->exclude, 1, 1);
+
+	dump_expr_multiline(ctx, flag, ctx->expr, 0, 0);
 }
 
 /**
@@ -3808,34 +3582,32 @@ void bfs_ctx_dump(const struct bfs_ctx *ctx, enum debug_flags flag) {
 static void dump_costs(const struct bfs_ctx *ctx) {
 	const struct bfs_expr *expr = ctx->expr;
 	bfs_debug(ctx, DEBUG_COST, "       Cost: ~${ylw}%g${rs}\n", expr->cost);
-	bfs_debug(ctx, DEBUG_COST, "Probability: ~${ylw}%g%%${rs}\n", 100.0*expr->probability);
+	bfs_debug(ctx, DEBUG_COST, "Probability: ~${ylw}%g%%${rs}\n", 100.0 * expr->probability);
 }
 
 struct bfs_ctx *bfs_parse_cmdline(int argc, char *argv[]) {
 	struct bfs_ctx *ctx = bfs_ctx_new();
 	if (!ctx) {
-		perror("bfs_new_ctx()");
+		perror("bfs_ctx_new()");
 		goto fail;
 	}
 
-	static char* default_argv[] = {BFS_COMMAND, NULL};
+	static char *default_argv[] = {BFS_COMMAND, NULL};
 	if (argc < 1) {
 		argc = 1;
 		argv = default_argv;
 	}
 
 	ctx->argc = argc;
-	ctx->argv = malloc((argc + 1)*sizeof(*ctx->argv));
+	ctx->argv = xmemdup(argv, sizeof_array(char *, argc + 1));
 	if (!ctx->argv) {
-		perror("malloc()");
+		perror("xmemdup()");
 		goto fail;
 	}
-	for (int i = 0; i <= argc; ++i) {
-		ctx->argv[i] = argv[i];
-	}
 
 	enum use_color use_color = COLOR_AUTO;
-	if (getenv("NO_COLOR")) {
+	const char *no_color = getenv("NO_COLOR");
+	if (no_color && *no_color) {
 		// https://no-color.org/
 		use_color = COLOR_NEVER;
 	}
@@ -3872,7 +3644,7 @@ struct bfs_ctx *bfs_parse_cmdline(int argc, char *argv[]) {
 		ctx->warn = stdin_tty;
 	}
 
-	struct parser_state state = {
+	struct bfs_parser parser = {
 		.ctx = ctx,
 		.argv = ctx->argv + 1,
 		.command = ctx->argv[0],
@@ -3889,40 +3661,36 @@ struct bfs_ctx *bfs_parse_cmdline(int argc, char *argv[]) {
 		.prune_arg = NULL,
 		.mount_arg = NULL,
 		.xdev_arg = NULL,
-		.files0_arg = NULL,
 		.files0_stdin_arg = NULL,
 		.ok_expr = NULL,
+		.now = ctx->now,
 	};
 
-	if (strcmp(xbasename(state.command), "find") == 0) {
-		// Operate depth-first when invoked as "find"
-		ctx->strategy = BFTW_DFS;
-	}
-
-	if (xgettime(&state.now) != 0) {
-		parse_perror(&state, "xgettime()");
+	ctx->exclude = parse_new_expr(&parser, eval_or, 1, &fake_or_arg);
+	if (!ctx->exclude) {
 		goto fail;
 	}
 
-	ctx->exclude = &bfs_false;
-	ctx->expr = parse_whole_expr(&state);
+	ctx->expr = parse_whole_expr(&parser);
 	if (!ctx->expr) {
-		if (state.just_info) {
+		if (parser.just_info) {
 			goto done;
 		} else {
 			goto fail;
 		}
 	}
 
+	if (parser.use_color == COLOR_AUTO && !ctx->colors) {
+		bfs_warning(ctx, "Error parsing $$LS_COLORS: %s.\n\n", xstrerror(ctx->colors_error));
+	}
+
 	if (bfs_optimize(ctx) != 0) {
+		bfs_perror(ctx, "bfs_optimize()");
 		goto fail;
 	}
 
-	if (darray_length(ctx->paths) == 0) {
-		if (!state.implicit_root) {
-			parse_argv_error(&state, state.files0_arg, 2, "No root paths specified.\n");
-			goto fail;
-		} else if (parse_root(&state, ".") != 0) {
+	if (ctx->npaths == 0 && parser.implicit_root) {
+		if (parse_root(&parser, ".") != 0) {
 			goto fail;
 		}
 	}