fix(cli): make spacy download --url actually use the custom URL

The custom-URL feature added in #13848 has been broken since release: any
value passed via `--url` is silently dropped (when the URL has no trailing
slash) or rejected by the post-construction guard (when it does), so the
flag cannot succeed under any input.

Two interlocking defects in `download_model`:

1. When `base_url` (= the user's custom URL) lacked a trailing slash, line
   183 reassigned it to `about.__download_url__ + "/"`, discarding the
   user's choice instead of just appending `/`.
2. The line-185 `startswith(about.__download_url__)` guard then rejected
   any URL that *was* preserved, because a custom mirror by definition
   does not start with the GitHub URL.

This change:

  * Appends `/` to the actual `base_url` instead of swapping it for the
    default.
  * Skips the GitHub-origin guard when `custom_url` is provided. The user
    has explicitly opted into a custom source via `--url`; the relative-
    path guard is still in force when no `--url` is passed, preserving
    the protection from #13848's review thread.

Adds a regression test exercising both trailing-slash variants of `--url`
plus the default-URL path so the relative-path rejection from
`test_download_rejects_relative_urls` keeps working.

Author: shaun0927

spacy/cli/download.py

@@ -180,9 +180,11 @@ def download_model(
     base_url = custom_url if custom_url else about.__download_url__
     # urljoin requires that the path ends with /, or the last path part will be dropped
     if not base_url.endswith("/"):
-        base_url = about.__download_url__ + "/"
+        base_url = base_url + "/"
     download_url = urljoin(base_url, filename)
-    if not download_url.startswith(about.__download_url__):
+    # Only enforce the GitHub-origin guard when the user did not opt into a
+    # custom URL. When --url is passed the user has explicitly chosen a source.
+    if custom_url is None and not download_url.startswith(about.__download_url__):
         raise ValueError(f"Download from {filename} rejected. Was it a relative path?")
     pip_args = list(user_pip_args) if user_pip_args is not None else []
     cmd = _get_pip_install_cmd() + pip_args + [download_url]

spacy/tests/test_cli.py

@@ -1237,3 +1237,34 @@ def test_download_rejects_relative_urls(monkeypatch):
     download_module.download("en_core_web_sm-3.7.1", direct=True)
     with pytest.raises(SystemExit):
         download_module.download("../en_core_web_sm-3.7.1", direct=True)
+
+
+def test_download_uses_custom_url(monkeypatch):
+    """`download_model(custom_url=...)` must actually use the user-supplied URL,
+    both with and without a trailing slash, instead of falling back to the
+    default GitHub URL or being rejected by the origin guard."""
+
+    captured = {}
+
+    def fake_run(cmd):
+        captured["url"] = next(arg for arg in cmd if arg.startswith("http"))
+
+    monkeypatch.setattr(download_module, "run_command", fake_run)
+    monkeypatch.setattr(
+        download_module, "_get_pip_install_cmd", lambda: ["pip", "install"]
+    )
+
+    for base in ("https://my-mirror.example.com/models", "https://my-mirror.example.com/models/"):
+        captured.clear()
+        download_module.download_model("foo-1.0.tar.gz", custom_url=base)
+        assert captured["url"].startswith("https://my-mirror.example.com/models/"), (
+            f"custom_url={base!r} produced {captured['url']!r}"
+        )
+
+    # Without --url, the default GitHub URL is still used and the relative-path
+    # guard remains in effect.
+    captured.clear()
+    download_module.download_model("foo-1.0.tar.gz")
+    assert captured["url"].startswith(about.__download_url__)
+    with pytest.raises(ValueError):
+        download_module.download_model("../foo-1.0.tar.gz")