Client::url() already prepends /api/v1, but all three registry token calls passed paths that started with /api/v1 themselves. Every request went to /api/v1/api/v1/registry/tokens, so the entire command has been non-functional since it shipped in #40:

$ anvil registry token list
Error: API error (404): server returned an HTML error page (expected JSON)

The correct path is confirmed by the server router, which mounts these under scope "/api/v1/registry".

Independent of #41 — touches a disjoint set of files, so the two can land in either order.

Guarding against a recurrence

Two guards, because each catches what the other misses:

• a debug_assert! in Client::url(), which fires when a bad path is actually requested;
• tests/api_paths.rs, which scans the source, so a bad path is caught even when no test exercises that command — which is precisely how this shipped.

I verified the static guard by reintroducing the bug. Worth mentioning because my first version of it silently passed: it collapsed existing whitespace but did not insert spaces around (, so the patterns never matched anything. It now fails on the broken path and passes on the fixed one.

One caveat on verification

I could not confirm the fix end-to-end against the live server. The /api/v1/registry/tokens route landed in 3535279, one commit before main’s HEAD, and the deployed server is v0.8.2 — which predates it. So the endpoint still 404s in production until Anvil is redeployed. The path matches the router source; that is as far as I can prove it today.