Colored Bits

coloredbits is a TypeScript library that gives every string in an LLM agent a provenance tag: every byte remembers where it came from — user input, tool output, retrieved document, model output, system prompt — and the runtime refuses to forget. Once a span is marked untrusted, the type system and runtime checks make it impossible to silently feed it into a higher-trust sink (a tool call, a downstream prompt, a SQL query) without an explicit, auditable downgrade. The hackathon submission ships a four-recipe cookbook that maps directly onto the prompt-injection literature: Chat rejects injection — refuse to dispatch a tool when the input would raise the conversation's trust floor. Spotlighting (Hines et al. 2024) — wrap untrusted spans in delimiters before the model reads them. Handle substitution (PFI / FIDES 2025) — seal high-trust spans behind opaque <<cb:handle:…>> tokens so the model can reference them without ever seeing them. RAG with provenance — propagateLiteralFragments re-attaches source URLs to the substrings the model copied verbatim, recovering per-character citations automatically. The motivation is personal. I rely on agents every day as a developer, a founder, and someone with ADHD — they genuinely changed my life, and they are also one prompt-injection away from leaking my partner's calendar or rewriting a repo. The future is agentic, and it has to be responsible. coloredbits is the missing primitive: one axis the agent cannot lose ;)