v1.17.1

chore: bump project version to 1.17.1

Leshiy Desktop desktop-v1.17.1

Desktop client bundles for desktop-v1.17.1.

Leshiy Android android-v1.17.1

Native Android APKs for android-v1.17.1: one per ABI (arm64-v8a for most phones, armeabi-v7a, x86_64) and a universal leshiy_vX.Y.Z.apk. Kotlin/Compose app.

v1.17.0

Release v1.17.0

v1.16.0

chore: bump version 1.15.0 -> 1.16.0

v1.15.0

v1.15.0

v1.14.0

Security maintenance for the CLI and server.

- rustls 0.23.45 (RUSTSEC-2026-0285: TLS 1.3 handshake messages were accepted
  across an encryption-level change) and der 0.8.2 (0.8.0 was yanked).

The rest of this version is the Android app — see android-v1.14.0.

Leshiy Android android-v1.15.0

Native Android APKs for android-v1.15.0: one per ABI (arm64-v8a for most phones, armeabi-v7a, x86_64) and a universal leshiy_vX.Y.Z.apk. Kotlin/Compose app.

Leshiy Android android-v1.14.0

Native Android APKs for android-v1.14.0: one per ABI (arm64-v8a for most phones, armeabi-v7a, x86_64) and a universal leshiy_vX.Y.Z.apk. Kotlin/Compose app.

v1.13.0

Adds an interactive mode to the whole CLI: `-i` asks for what it needs instead of
requiring you to look the flags up first.

- `leshiy connect -i` asks how you want to connect — local proxy, full-device
  VPN, VPN via the helper, or a background service, showing which of those this
  machine can actually run — and then which server, picked from the ones you
  provisioned rather than making you paste a link.
- `leshiy remote provision -i` walks through standing a server up on a fresh VPS:
  SSH target, a list of camouflage sites (live-probed for TLS 1.3), role, ports,
  and a review of exactly what it will do before it touches anything.
- `leshiy quickstart -i` does the same on the machine you are already on, and
  detects its public address for you.
- Day-2 commands — `remote status/upgrade/backup/restore/teardown` and
  `remote user add/ls/rm` — let you pick a saved server from a list instead of
  typing its id, and `service start -i` installs the background service.

Flags still win. Anything you pass is not asked about, and every wizard ends by
printing the equivalent flag-only command, so a run teaches the scriptable form
rather than hiding it.

Bearer credentials are treated as such throughout: client links and exit
connector credentials are entered through hidden prompts and never rendered into
the echoed command, and the full-tunnel sudo re-exec hands the URI to the
elevated process in a 0600 file instead of argv, where `ps` would expose it.

The non-interactive CLI is unchanged, and the README has been rewritten around
the shorter path.