apexe 0.6.1

Outside-In CLI-to-Agent Bridge
{
  "schema_version": "1.0",
  "command": "find",
  "variant": "gnu",
  "match": {
    "probe": {
      "args": ["--version"],
      "expect": "success",
      "output_contains": "GNU findutils"
    }
  },
  "mode": "authoritative",
  "confidence": "verified",
  "provenance": {
    "platform": "linux",
    "tool_version": "4.10.0",
    "package": "findutils",
    "source": "man-page",
    "checked_on": "2026-07-29",
    "command": "docker run --rm debian@sha256:328d16499860ae6cb9b345e2e4cebca08c2a36e4f7278482c7bd1f39d71e5bfd sh -c 'rm -f /etc/dpkg/dpkg.cfg.d/docker*; apt-get update -qq && apt-get install -y -qq --reinstall findutils man-db && man find | col -b'",
    "environment": "debian@sha256:328d16499860ae6cb9b345e2e4cebca08c2a36e4f7278482c7bd1f39d71e5bfd",
    "notes": "Debian slim images ship no man pages, so the list was read from GNU --help, which for find is a bare index -- it names every operator, option, test and action but gives no argument shape and no description for any of them. Each entry was therefore run against the binary to establish its argument count and behaviour, and an unknown one is rejected as 'unknown predicate'. mode is authoritative on that basis, but only after a second pass, because --help turned out NOT to be exhaustive. Six things the binary accepts are missing from it, each of which was run before being listed here: -samefile, -ipath (--help lists only the -iwholename synonym), -d (a synonym of -depth, and a predicate rather than a pre-path option -- 'find /tmp -d' works while 'find -d /tmp' fails with 'paths must precede expression'), the single-dash -help and -version aliases, and the whole -newerXY family. A seventh candidate, -noop, was tested and rejected as an unknown predicate. The -newerXY family is not in --help at all; the whole 5x5 grid was run, and X over a/B/c/m with Y over a/B/c/m/t is accepted (20 combinations) while every X=t form is rejected as 'invalid predicate', so exactly those 20 are listed. On a file system without birth-time support the eight B forms print 'This system does not provide a way to find the birth time of a file.' AND are then rejected as an invalid predicate -- both messages appear, so calling it a purely runtime limit was wrong; the descriptions now carry the man page's own rule, that an unsupported XY combination is a fatal error. The 20 -newerXY descriptions are transcribed from the findutils man page. They previously carried FreeBSD's wording for the same semantics, which was a cross-variant copy of exactly the kind this project forbids, and --help could not have been their source because it gives no description for any predicate. The man page is reachable in this image only after removing the slim variant's dpkg path-exclude rules and reinstalling findutils and man-db, which is what the command field records; source is therefore man-page, while the flag *list* remains what --help plus direct invocation established. Four parts of the syntax the overlay format cannot carry: the grouping, negation and list operators '(', ')', '!' and ',' are not dash-prefixed; -exec and -execdir have two forms distinguished by their terminator, ';' or '{} +', which is a property of the argument list; -Olevel and -D debugopts are written attached and comma-joined in the SYNOPSIS, so they are recorded with the shapes the binary actually accepts ('find -O2' works while 'find -O 2' does not, and 'find -D tree' takes its value separated); and -files0-from is a single-dash option, NOT a long one -- '--files0-from=f0' is rejected as an unknown predicate while '-files0-from f0' works, which is easy to get backwards. BSD-only primaries were tested and rejected here, confirming the boundary: -acl, -sparse, -xattr, -xattrname, -flags, -Bmin, -Bnewer, -Btime and -mnewer are all 'unknown predicate'. conflicts_with was read off the running binary, which is also the only prose GNU find offers on the subject. Declared: -delete with -prune, diagnosed in full as 'The -delete action automatically turns on -depth, but -prune does nothing when -depth is in effect'; and -prune with -depth, from the same sentence, confirmed behaviourally because with -depth the pruned subtree is still listed. Candidates tested and REJECTED: -delete with -depth is explicitly blessed by that same message and was confirmed to work; -delete with -L is accepted here and deletes the file, which is a real difference from BSD find, where the pairing is refused outright -- the conflicts on each side were derived from that side's own evidence and not copied across; and 'find -H -L -P' is accepted at exit 0 with the last one winning -- an override group, now recorded as a conflict for the reason given at the end of these notes. No flag here is marked long_running: find terminates once the traversal finishes, and nothing in the option set is a follow-style switch like tail -f. -exec can invoke a program that never returns, but that is a property of the invoked utility rather than of the flag. annotations: readonly is FALSE. The scanner's name heuristic classifies 'find' readonly and its flag heuristic would then escalate requires_approval on -delete anyway; the overlay states the answer outright rather than leaving it to two heuristics that happen to cancel out. -delete removes files, -exec/-execdir/-ok/-okdir run an arbitrary utility, and -fprint, -fprint0, -fprintf and -fls each truncate and rewrite a named file. destructive is therefore true, idempotent is false because -exec runs a command whose repetition this overlay cannot reason about, and requires_approval is true. The annotation describes the command's whole invocable surface, not its default -print action. conflicts_with was extended in a later pass, after the field's definition widened to cover override groups as well as diagnosed errors: apexe's input is a JSON object, which carries no ordering, so for a last-one-wins group which flag actually wins is decided by the order the caller happened to write the keys in. Every pair added then was run in BOTH orders against the reference build recorded above, and only pairs whose outcome depends on that order, or where one side is silently discarded, were added. before_flags on the path operand was added on 2026-07-29 and checked behaviourally on the same pinned image: 'find -name \"*.txt\" /t' fails with 'paths must precede expression: `/t`' and exit 1, while 'find /t -name \"*.txt\"' lists the match and exits 0. Recorded once on the operand rather than on each test/action, since the constraint is on operand placement and not on any individual predicate. before_operands was added on 2026-07-29 for the same reason as the BSD side: before_flags alone pushed GNU find's true options behind the path, where this build rejects them. Each was run in both positions on the same pinned image: -H -L -P and -O2 are accepted before the path and rejected after it with \"unknown predicate\" (exit 1); -D takes its value separated and behaves identically ('find -D tree /t' prints the debug header, 'find /t -D tree' is \"unknown predicate `-D'\"); -files0-from is marked too, since it supplies the paths itself and 'find /t -files0-from f0' fails with \"extra operand '/t'\". Six flags carry the marker. The predicates keep the trailing position that before_flags gave them. end_of_options was added on 2026-07-30 and checked on the same pinned image. This find consumes '--' while scanning its leading options, i.e. only in the run of tokens before the starting points: 'find -- . -name \"*.txt\"', 'find -L -H -- . -name \"*.txt\"', 'find -O2 -- . -name \"*.txt\"' and 'find -D tree -- . -name \"*.txt\"' all list the matches and exit 0, while 'find . -- -name \"*.txt\"' is \"find: unknown predicate `--'\" (exit 1) -- the same one-position rule as BSD find, reached by a different route. 'find --' with no starting point falls back to '.' and exits 0. Two limits were established at the same time and are worth recording. First, '--' does not rescue a starting point that begins with '-': 'find -- -weird-dir' is \"find: unknown predicate `-weird-dir'\", exactly as on BSD, so the separator protects the expression rather than the paths. Second, it is NOT accepted after -files0-from, which is not one of the leading options: 'find -files0-from f0 -- -name \"*.txt\"' is \"unknown predicate `--'\" (exit 1) while 'find -files0-from f0 -name \"*.txt\"' works at exit 0. That combination is the one shape the marker mis-serves here, and it costs nothing that GNU find needs, because GNU find parses its predicates itself and never mistakes one for an option."
  },
  "description": "Walk a file hierarchy. Default path is the current directory; default expression is -print. An expression may consist of operators, options, tests and actions. The operators, in decreasing precedence with -and implicit where no others are given, are '( EXPR )', '! EXPR' or -not EXPR, 'EXPR1 -a EXPR2' or -and, 'EXPR1 -o EXPR2' or -or, and 'EXPR1 , EXPR2'. Tests taking N accept +N, -N or N for more than, less than and exactly N. Positional options and normal options are always true and are meant to be given before the other expressions.",
  "end_of_options": true,
  "flags": [
    { "short": "-H", "before_operands": true, "type": "boolean", "conflicts_with": ["-L", "-P"], "description": "Do not follow symbolic links, except while processing the command line arguments. The last of -H, -L and -P wins; they are accepted together." },
    { "short": "-L", "before_operands": true, "type": "boolean", "conflicts_with": ["-H", "-P"], "description": "Follow symbolic links. The last of -H, -L and -P wins; they are accepted together." },
    { "short": "-P", "before_operands": true, "type": "boolean", "conflicts_with": ["-H", "-L"], "description": "Never follow symbolic links. This is the default. The last of -H, -L and -P wins; they are accepted together." },
    { "short": "-O", "before_operands": true, "type": "integer", "value_name": "level", "description": "Enable query optimisation at the given level. The level must be attached, as in -O2; 'find -O 2' fails with 'The -O option must be immediately followed by a decimal integer'." },
    { "short": "-D", "before_operands": true, "type": "enum", "value_name": "debugopts", "enum_values": ["exec", "opt", "rates", "search", "stat", "time", "tree", "all", "help"], "description": "Print diagnostic information about the named subsystem. Several may be given as one comma-separated argument, and 'find -D help' describes them. The value may be separated, as in 'find -D tree'." },
    { "short": "-daystart", "type": "boolean", "description": "Positional option, always true. Measure times from the beginning of today rather than from 24 hours ago. It affects only the tests that follow it." },
    { "short": "-follow", "type": "boolean", "description": "Positional option, always true. Deprecated; dereference symbolic links, as -L does globally." },
    { "short": "-nowarn", "type": "boolean", "description": "Positional option, always true. Turn warning messages off." },
    { "short": "-warn", "type": "boolean", "description": "Positional option, always true. Turn warning messages on." },
    { "short": "-regextype", "type": "enum", "value_name": "TYPE", "enum_values": ["findutils-default", "ed", "emacs", "gnu-awk", "grep", "posix-awk", "awk", "posix-basic", "posix-egrep", "egrep", "posix-extended", "posix-minimal-basic", "sed"], "description": "Positional option, always true. Change the regular expression syntax understood by -regex and -iregex for the tests that follow it. The 13 names listed here are the ones the binary reports when an unknown one is given; there is no 'help' value, so 'find -regextype help' is an error rather than a listing." },
    { "short": "-depth", "type": "boolean", "conflicts_with": ["-prune"], "description": "Normal option, always true. Process each directory's contents before the directory itself. Unlike BSD find this takes no argument here; the depth test is spelled -maxdepth/-mindepth." },
    { "short": "-d", "type": "boolean", "conflicts_with": ["-prune"], "description": "A synonym of -depth, absent from --help. It is a predicate here and not a pre-path option: 'find /tmp -d' works while 'find -d /tmp' fails with 'paths must precede expression', which is where it differs from the BSD -d option it emulates." },
    { "short": "-files0-from", "before_operands": true, "type": "path", "value_name": "FILE", "description": "Normal option. Read the starting points from FILE, one NUL-terminated name per record; if FILE is - then read them from standard input. This is a single-dash option even though it is multi-letter: '--files0-from=FILE' is rejected as an unknown predicate. It replaces the path operands, and giving one as well fails with 'file operands cannot be combined with -files0-from'." },
    { "short": "-maxdepth", "type": "integer", "value_name": "LEVELS", "description": "Normal option, always true. Descend at most LEVELS levels of directories below the starting points. -maxdepth 0 applies the tests and actions to the starting points themselves." },
    { "short": "-mindepth", "type": "integer", "value_name": "LEVELS", "description": "Normal option, always true. Do not apply any tests or actions at levels less than LEVELS. -mindepth 1 processes all files except the starting points." },
    { "short": "-mount", "type": "boolean", "description": "Normal option, always true. Do not descend into directories on other file systems; a synonym for -xdev." },
    { "short": "-noleaf", "type": "boolean", "description": "Normal option, always true. Do not optimise by assuming that directories contain 2 fewer subdirectories than their hard link count. Needed for file systems that do not follow the Unix directory-link convention." },
    { "short": "-xdev", "type": "boolean", "description": "Normal option, always true. Do not descend into directories on other file systems." },
    { "short": "-ignore_readdir_race", "type": "boolean", "description": "Normal option, always true. Do not report an error for a file that disappeared between find reading its name from a directory and stat'ing it." },
    { "short": "-noignore_readdir_race", "type": "boolean", "description": "Normal option, always true. Turn off the effect of -ignore_readdir_race. This is the default." },
    { "short": "-amin", "type": "string", "value_name": "N", "description": "True if the file was last accessed N minutes ago. N may be written +N, -N or N for more than, less than and exactly N." },
    { "short": "-anewer", "type": "path", "value_name": "FILE", "description": "True if the file was last accessed more recently than FILE was modified." },
    { "short": "-atime", "type": "string", "value_name": "N", "description": "True if the file was last accessed N*24 hours ago. N may be written +N, -N or N." },
    { "short": "-cmin", "type": "string", "value_name": "N", "description": "True if the file's status was last changed N minutes ago. N may be written +N, -N or N." },
    { "short": "-cnewer", "type": "path", "value_name": "FILE", "description": "True if the file's status was last changed more recently than FILE was modified." },
    { "short": "-context", "type": "string", "value_name": "CONTEXT", "description": "True if the file's SELinux security context matches CONTEXT. On a host where SELinux is not enabled the binary rejects it with 'invalid predicate -context: SELinux is not enabled.', so its availability is a property of the host rather than of the build." },
    { "short": "-ctime", "type": "string", "value_name": "N", "description": "True if the file's status was last changed N*24 hours ago. N may be written +N, -N or N." },
    { "short": "-empty", "type": "boolean", "description": "True if the file is an empty regular file or an empty directory." },
    { "short": "-false", "type": "boolean", "description": "Always false." },
    { "short": "-fstype", "type": "string", "value_name": "TYPE", "description": "True if the file is on a file system of type TYPE." },
    { "short": "-gid", "type": "string", "value_name": "N", "description": "True if the file's numeric group ID is N. N may be written +N, -N or N." },
    { "short": "-group", "type": "string", "value_name": "NAME", "description": "True if the file belongs to group NAME, which may also be a numeric group ID." },
    { "short": "-ilname", "type": "string", "value_name": "PATTERN", "description": "Like -lname, but the match is case insensitive." },
    { "short": "-iname", "type": "string", "value_name": "PATTERN", "description": "Like -name, but the match is case insensitive." },
    { "short": "-inum", "type": "string", "value_name": "N", "description": "True if the file has inode number N. N may be written +N, -N or N." },
    { "short": "-iwholename", "type": "string", "value_name": "PATTERN", "description": "Like -wholename, but the match is case insensitive. A synonym of -ipath." },
    { "short": "-ipath", "type": "string", "value_name": "PATTERN", "description": "Like -path, but the match is case insensitive. A synonym of -iwholename, which is the only one of the two that --help lists." },
    { "short": "-iregex", "type": "string", "value_name": "PATTERN", "description": "Like -regex, but the match is case insensitive." },
    { "short": "-links", "type": "string", "value_name": "N", "description": "True if the file has N hard links. N may be written +N, -N or N." },
    { "short": "-lname", "type": "string", "value_name": "PATTERN", "description": "True if the file is a symbolic link whose contents match PATTERN." },
    { "short": "-mmin", "type": "string", "value_name": "N", "description": "True if the file's data was last modified N minutes ago. N may be written +N, -N or N." },
    { "short": "-mtime", "type": "string", "value_name": "N", "description": "True if the file's data was last modified N*24 hours ago. N may be written +N, -N or N." },
    { "short": "-name", "type": "string", "value_name": "PATTERN", "description": "True if the base of the file name matches the shell PATTERN. The metacharacters do not treat '/' or a leading '.' specially." },
    { "short": "-newer", "type": "path", "value_name": "FILE", "description": "True if the file was modified more recently than FILE." },
    { "short": "-neweraa", "type": "path", "value_name": "reference", "description": "Succeeds if the access time of the file being considered is newer than the access time of the reference file." },
    { "short": "-neweraB", "type": "path", "value_name": "reference", "description": "Succeeds if the access time of the file being considered is newer than the birth time of the reference file. B is not supported on all systems; where the reference file's birth time cannot be determined, a fatal error results." },
    { "short": "-newerac", "type": "path", "value_name": "reference", "description": "Succeeds if the access time of the file being considered is newer than the inode status change time of the reference file." },
    { "short": "-neweram", "type": "path", "value_name": "reference", "description": "Succeeds if the access time of the file being considered is newer than the modification time of the reference file." },
    { "short": "-newerat", "type": "string", "value_name": "TIME", "description": "Succeeds if the access time of the file being considered is newer than the given time. The argument is interpreted directly as a time, as for the -d option of GNU date." },
    { "short": "-newerBa", "type": "path", "value_name": "reference", "description": "Succeeds if the birth time of the file being considered is newer than the access time of the reference file. This test fails for any file whose own birth time is unknown." },
    { "short": "-newerBB", "type": "path", "value_name": "reference", "description": "Succeeds if the birth time of the file being considered is newer than the birth time of the reference file. B is not supported on all systems; where the reference file's birth time cannot be determined, a fatal error results. This test fails for any file whose own birth time is unknown." },
    { "short": "-newerBc", "type": "path", "value_name": "reference", "description": "Succeeds if the birth time of the file being considered is newer than the inode status change time of the reference file. This test fails for any file whose own birth time is unknown." },
    { "short": "-newerBm", "type": "path", "value_name": "reference", "description": "Succeeds if the birth time of the file being considered is newer than the modification time of the reference file. This test fails for any file whose own birth time is unknown." },
    { "short": "-newerBt", "type": "string", "value_name": "TIME", "description": "Succeeds if the birth time of the file being considered is newer than the given time. The argument is interpreted directly as a time, as for the -d option of GNU date. This test fails for any file whose own birth time is unknown." },
    { "short": "-newerca", "type": "path", "value_name": "reference", "description": "Succeeds if the inode status change time of the file being considered is newer than the access time of the reference file." },
    { "short": "-newercB", "type": "path", "value_name": "reference", "description": "Succeeds if the inode status change time of the file being considered is newer than the birth time of the reference file. B is not supported on all systems; where the reference file's birth time cannot be determined, a fatal error results." },
    { "short": "-newercc", "type": "path", "value_name": "reference", "description": "Succeeds if the inode status change time of the file being considered is newer than the inode status change time of the reference file." },
    { "short": "-newercm", "type": "path", "value_name": "reference", "description": "Succeeds if the inode status change time of the file being considered is newer than the modification time of the reference file." },
    { "short": "-newerct", "type": "string", "value_name": "TIME", "description": "Succeeds if the inode status change time of the file being considered is newer than the given time. The argument is interpreted directly as a time, as for the -d option of GNU date." },
    { "short": "-newerma", "type": "path", "value_name": "reference", "description": "Succeeds if the modification time of the file being considered is newer than the access time of the reference file." },
    { "short": "-newermB", "type": "path", "value_name": "reference", "description": "Succeeds if the modification time of the file being considered is newer than the birth time of the reference file. B is not supported on all systems; where the reference file's birth time cannot be determined, a fatal error results." },
    { "short": "-newermc", "type": "path", "value_name": "reference", "description": "Succeeds if the modification time of the file being considered is newer than the inode status change time of the reference file." },
    { "short": "-newermm", "type": "path", "value_name": "reference", "description": "Succeeds if the modification time of the file being considered is newer than the modification time of the reference file." },
    { "short": "-newermt", "type": "string", "value_name": "TIME", "description": "Succeeds if the modification time of the file being considered is newer than the given time. The argument is interpreted directly as a time, as for the -d option of GNU date." },
    { "short": "-nouser", "type": "boolean", "description": "True if no user corresponds to the file's numeric user ID." },
    { "short": "-nogroup", "type": "boolean", "description": "True if no group corresponds to the file's numeric group ID." },
    { "short": "-path", "type": "string", "value_name": "PATTERN", "description": "True if the whole file name matches the shell PATTERN. A synonym of -wholename." },
    { "short": "-perm", "type": "string", "value_name": "[-/]MODE", "description": "True if the file's permission bits match MODE, which may be symbolic or octal. A leading dash means all of the bits in MODE must be set; a leading slash means any of them must be set; with neither, the bits must match exactly." },
    { "short": "-regex", "type": "string", "value_name": "PATTERN", "description": "True if the whole file name matches the regular expression PATTERN. The syntax is the one selected by the most recent -regextype." },
    { "short": "-readable", "type": "boolean", "description": "True if the file is readable by the current user, as access(2) reports rather than as the permission bits suggest." },
    { "short": "-writable", "type": "boolean", "description": "True if the file is writable by the current user, as access(2) reports rather than as the permission bits suggest." },
    { "short": "-executable", "type": "boolean", "description": "True if the file is executable, or searchable in the case of a directory, by the current user." },
    { "short": "-wholename", "type": "string", "value_name": "PATTERN", "description": "True if the whole file name matches the shell PATTERN. A synonym of -path." },
    { "short": "-samefile", "type": "path", "value_name": "NAME", "description": "True if the file refers to the same inode as NAME. When -L is in effect, symbolic links to NAME match too." },
    { "short": "-size", "type": "string", "value_name": "N[bcwkMG]", "description": "True if the file uses N units of space, rounded up. The units are b for 512-byte blocks (the default), c for bytes, w for two-byte words, k for kibibytes, M for mebibytes and G for gibibytes. N may be written +N, -N or N." },
    { "short": "-true", "type": "boolean", "description": "Always true." },
    { "short": "-type", "type": "enum", "value_name": "[bcdpflsD]", "enum_values": ["b", "c", "d", "p", "f", "l", "s", "D"], "description": "True if the file is of the given type: b block special, c character special, d directory, p named pipe, f regular file, l symbolic link, s socket, D door. Several letters may be given as one comma-separated argument, as in -type f,d. D is listed in --help but is refused on a host whose find was not built with Solaris door support, which is a property of the host rather than of the option." },
    { "short": "-uid", "type": "string", "value_name": "N", "description": "True if the file's numeric user ID is N. N may be written +N, -N or N." },
    { "short": "-used", "type": "string", "value_name": "N", "description": "True if the file was last accessed N days after its status was last changed. N may be written +N, -N or N." },
    { "short": "-user", "type": "string", "value_name": "NAME", "description": "True if the file is owned by user NAME, which may also be a numeric user ID." },
    { "short": "-xtype", "type": "enum", "value_name": "[bcdpfls]", "enum_values": ["b", "c", "d", "p", "f", "l", "s"], "description": "The same as -type unless the file is a symbolic link, in which case it tests the type of the file the link points to when -type would test the link itself, and the other way round. --help omits D here; the binary parses it and then refuses it with the same Solaris-doors diagnostic as -type." },
    { "short": "-delete", "type": "boolean", "conflicts_with": ["-prune"], "description": "Delete files and directories; always true if the removal succeeded. It automatically turns on -depth, which is why giving -prune as well is refused. Directories are removed only when empty. Because the removal happens as the primary is evaluated, it should normally come last in the expression." },
    { "short": "-print", "type": "boolean", "description": "Always true. Print the full file name on standard output, followed by a newline." },
    { "short": "-print0", "type": "boolean", "description": "Always true. Print the full file name on standard output, followed by a null character, so that names containing newlines survive being read by another program." },
    { "short": "-printf", "type": "string", "value_name": "FORMAT", "description": "Always true. Print FORMAT on standard output, interpreting '\\' escapes and '%' directives. No newline is added unless the format asks for one." },
    { "short": "-fprint", "type": "path", "value_name": "FILE", "description": "Always true. Print the full file name into FILE, which is created if it does not exist and TRUNCATED if it does." },
    { "short": "-fprint0", "type": "path", "value_name": "FILE", "description": "Always true. Like -print0 but write into FILE, which is created if it does not exist and TRUNCATED if it does." },
    { "short": "-fprintf", "type": "string", "value_name": "FILE FORMAT", "description": "Always true. Like -printf but write into FILE, which is created if it does not exist and TRUNCATED if it does. It takes two arguments, the file first and the format second." },
    { "short": "-ls", "type": "boolean", "description": "Always true. List the current file in 'ls -dils' format on standard output." },
    { "short": "-fls", "type": "path", "value_name": "FILE", "description": "Always true. Like -ls but write into FILE, which is created if it does not exist and TRUNCATED if it does." },
    { "short": "-prune", "type": "boolean", "conflicts_with": ["-depth", "-delete"], "description": "True. If the file is a directory, do not descend into it. If -depth is in effect, -prune has no effect -- but it still evaluates true, so an expression relying on its truth value is unaffected. The binary states the -depth interaction outright when refusing -delete -prune." },
    { "short": "-quit", "type": "boolean", "description": "Exit immediately with the current exit status, running no further commands. Pending -execdir invocations are still run first." },
    { "short": "-exec", "type": "string", "value_name": "COMMAND ;", "description": "Execute COMMAND; true if its exit status is 0. Everything up to a ';' argument is taken to be part of the command, and '{}' is replaced by the current file name. In the alternative form terminated by '{} +', '{}' is replaced with as many file names as fit on one command line, the primary is always true, and find returns a non-zero exit status if at least one invocation did. The command runs from the directory find was started in." },
    { "short": "-execdir", "type": "string", "value_name": "COMMAND ;", "description": "Like -exec, but the command runs from the directory holding the matched file and '{}' expands to a name relative to it. Both the ';' and '{} +' terminators are accepted." },
    { "short": "-ok", "type": "string", "value_name": "COMMAND ;", "description": "Like -exec, but prompt on standard error first and run the command only if the answer begins with 'y' or 'Y'. Only the ';' terminator is accepted." },
    { "short": "-okdir", "type": "string", "value_name": "COMMAND ;", "description": "Like -execdir, but prompt on standard error first and run the command only if the answer begins with 'y' or 'Y'. Only the ';' terminator is accepted." },
    { "short": "-not", "type": "boolean", "description": "The unary NOT operator, also spelled '!'. True if the following expression is false." },
    { "short": "-a", "type": "boolean", "description": "The logical AND operator, implied by the juxtaposition of two expressions." },
    { "short": "-and", "type": "boolean", "description": "The logical AND operator, implied by the juxtaposition of two expressions." },
    { "short": "-o", "type": "boolean", "description": "The logical OR operator; the second expression is not evaluated if the first is true." },
    { "short": "-or", "type": "boolean", "description": "The logical OR operator; the second expression is not evaluated if the first is true." },
    { "long": "--help", "type": "boolean", "description": "Display this help and exit. The help is an index of operators, options, tests and actions with no per-entry description." },
    { "long": "--version", "type": "boolean", "description": "Output version information and exit. This build answers with 'find (GNU findutils) 4.10.0'." },
    { "short": "-help", "type": "boolean", "description": "A single-dash alias of --help, absent from --help's own output but accepted and producing identical output." },
    { "short": "-version", "type": "boolean", "description": "A single-dash alias of --version, absent from --help but accepted and producing identical output." }
  ],
  "positional_args": [
    { "name": "path", "type": "path", "variadic": true, "required": false, "before_flags": true, "description": "Starting points for the walk. With none, the current directory is used. Not given when -files0-from supplies them, which rejects any path operand with 'file operands cannot be combined with -files0-from'. Must be rendered before the tests and actions: a path after a predicate is refused with 'paths must precede expression'." },
    { "name": "expression", "type": "string", "variadic": true, "required": false, "description": "The operators, options, tests and actions evaluated for each file. With no action the default expression is -print." }
  ],
  "annotations": {
    "readonly": false,
    "destructive": true,
    "idempotent": false,
    "requires_approval": true
  }
}