1 files changed, 32 insertions, 0 deletions
diff --git a/src/lua_runtime.zig b/src/lua_runtime.zig
index 5efadaa..fed56a8 100644
--- a/src/lua_runtime.zig
+++ b/src/lua_runtime.zig
@@ -354,6 +354,38 @@ pub const LuaRuntime = struct {
     pub fn toolCount(self: *const LuaRuntime) usize {
         return self.decls.items.len;
     }
+
+    /// Drop every declared tool whose registered name is rejected by
+    /// `permits`. The handler ref is unref'd and the decl removed.
+    /// Returns the number of tools dropped.
+    ///
+    /// String storage for a dropped tool's name/description/schema is
+    /// left in `self.strings` (freed at `deinit`); only the decl entry
+    /// and the Lua handler ref are reclaimed eagerly. This keeps the
+    /// filter simple — we never need to find-and-free individual
+    /// strings out of the shared pool.
+    pub fn filterTools(
+        self: *LuaRuntime,
+        ctx: anytype,
+        comptime permits: fn (@TypeOf(ctx), []const u8) bool,
+    ) usize {
+        var dropped: usize = 0;
+        var i: usize = 0;
+        while (i < self.decls.items.len) {
+            const name = self.decls.items[i].name;
+            if (permits(ctx, name)) {
+                i += 1;
+                continue;
+            }
+            // Unref the handler, if present.
+            if (self.handlers.fetchRemove(name)) |kv| {
+                c.luaL_unref(self.L, lua_bridge.LUA_REGISTRYINDEX, kv.value);
+            }
+            _ = self.decls.orderedRemove(i);
+            dropped += 1;
+        }
+        return dropped;
+    }
 };
 
 const source_vtable: panto.ToolSource.VTable = .{