diff --git a/package.json b/package.json
index 05675d6..3f5cce5 100644
--- a/package.json
+++ b/package.json
@@ -77,7 +77,7 @@
 			"ip-address": ">=10.1.1",
 			"postcss": ">=8.5.10",
 			"qs": ">=6.15.2",
-			"tar": ">=7.5.16",
+			"tar": ">=7.5.18",
 			"vite": "8.0.16"
 		}
 	}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7cdbc7b..e6922c5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -12,7 +12,7 @@ overrides:
   ip-address: '>=10.1.1'
   postcss: '>=8.5.10'
   qs: '>=6.15.2'
-  tar: '>=7.5.16'
+  tar: '>=7.5.18'
   vite: 8.0.16
 
 importers:
@@ -1352,8 +1352,8 @@ packages:
   tar-stream@3.1.8:
     resolution: {integrity: sha512-U6QpVRyCGHva435KoNWy9PRoi2IFYCgtEhq9nmrPPpbRacPs9IH4aJ3gbrFC8dPcXvdSZ4XXfXT5Fshbp2MtlQ==}
 
-  tar@7.5.16:
-    resolution: {integrity: sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==}
+  tar@7.5.20:
+    resolution: {integrity: sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==}
     engines: {node: '>=18'}
 
   teex@1.0.1:
@@ -1968,7 +1968,7 @@ snapshots:
       resolve: 1.22.11
       resolve.exports: 2.0.3
       stream-meter: 1.0.4
-      tar: 7.5.16
+      tar: 7.5.20
       tinyglobby: 0.2.17
       unzipper: 0.12.3
     transitivePeerDependencies:
@@ -2789,7 +2789,7 @@ snapshots:
       - bare-buffer
       - react-native-b4a
 
-  tar@7.5.16:
+  tar@7.5.20:
     dependencies:
       '@isaacs/fs-minipass': 4.0.1
       chownr: 3.0.0
diff --git a/scripts/gen-docs-reference.ts b/scripts/gen-docs-reference.ts
index b7f0f7e..5596d9a 100644
--- a/scripts/gen-docs-reference.ts
+++ b/scripts/gen-docs-reference.ts
@@ -12,7 +12,7 @@
  * Default --out is ../elnora-docs/content/docs/cli (sibling repo layout).
  */
 
-import { mkdirSync, writeFileSync, readdirSync, rmSync } from "node:fs";
+import { mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { z } from "zod";
 import { buildRegistry } from "../src/core/build-registry.js";
@@ -50,7 +50,11 @@ function inlineText(s: string | undefined): string {
 
 function frontmatterValue(s: string): string {
 	// double-quoted YAML scalar
-	return `"${(s ?? "").replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r?\n+/g, " ").trim()}"`;
+	return `"${(s ?? "")
+		.replace(/\\/g, "\\\\")
+		.replace(/"/g, '\\"')
+		.replace(/\r?\n+/g, " ")
+		.trim()}"`;
 }
 
 // ---------------------------------------------------------------------------
@@ -163,9 +167,7 @@ function renderCommand(cmd: ElnoraCommand): string {
 		out += "| Parameter | Type | Required | Description |\n";
 		out += "| --- | --- | --- | --- |\n";
 		for (const r of rows) {
-			out += `| \`${r.name}\` | ${r.type} | ${r.required ? "yes" : "no"} | ${inlineText(
-				r.description,
-			)} |\n`;
+			out += `| \`${r.name}\` | ${r.type} | ${r.required ? "yes" : "no"} | ${inlineText(r.description)} |\n`;
 		}
 		out += "\n";
 	}
@@ -211,13 +213,14 @@ for (const f of readdirSync(outDir)) {
 const groupTitle = (g: string) => g.replace(/(^|-)([a-z])/g, (_, p, c) => (p ? " " : "") + c.toUpperCase());
 
 for (const group of allGroups) {
-	const cmds = registry.byGroup(group).filter(isPublic).sort((a, b) => a.name.localeCompare(b.name));
+	const cmds = registry
+		.byGroup(group)
+		.filter(isPublic)
+		.sort((a, b) => a.name.localeCompare(b.name));
 	if (cmds.length === 0) continue; // group is entirely internal — no public page
 	renderedGroups.push(group);
 	const blurb = GROUP_BLURB[group] ?? `${cmds.length} \`${group}\` commands.`;
-	let body = `---\ntitle: ${frontmatterValue(groupTitle(group))}\ndescription: ${frontmatterValue(
-		blurb,
-	)}\n---\n\n`;
+	let body = `---\ntitle: ${frontmatterValue(groupTitle(group))}\ndescription: ${frontmatterValue(blurb)}\n---\n\n`;
 	body += `${blurb}\n\n`;
 	for (const cmd of cmds) body += renderCommand(cmd);
 	writeFileSync(join(outDir, `${group}.mdx`), body, "utf-8");
@@ -274,7 +277,10 @@ These apply to every command:
 ## Command groups
 
 ${renderedGroups
-	.map((g) => `- [\`${g}\`](/docs/cli/${g}) — ${GROUP_BLURB[g] ?? `${registry.byGroup(g).filter(isPublic).length} commands`}`)
+	.map(
+		(g) =>
+			`- [\`${g}\`](/docs/cli/${g}) — ${GROUP_BLURB[g] ?? `${registry.byGroup(g).filter(isPublic).length} commands`}`,
+	)
 	.join("\n")}
 
 > Most of these operations are also available over the hosted MCP server. See **MCP & integrations** for the tool catalog and connection steps.