Sandboxlib

- Sandstorm for Work: The sharing dialog auto-complete will now automatically be populated with all known members of your organization. (This can be turned off in the admin settings if the membership of your organization should be kept secret from its own members.)
- Error messages informing the user that they need to log in as a different identity now allow the identity cards to be clicked to immediately initiate login as that identity, rather than requiring the user to use the sign-in menu manually.
- Improved login provider first-time setup UI.
- Updated to Meteor 1.3.x, a major Meteor update. No changes to Sandstorm, but many dependencies have changed, possibly introducing new bugs.
- Fixed redirect loop that could happen when following a sharing link after the sharer has unlinked from their account the identity that they had used when sharing.
- Fixed that paths marked hidden in a package's `sandstorm-pkgdef.capnp` would still appear under `spk dev` when listing the parent directory (though the paths were not actually accessible).
- Sandstorm for Work: Fixed some cases where LDAP and SAML users were being handled incorrectly, such as when trying to auto-complete such users in the sharing dialog.
- Oasis: Fixed subtle storage-related bug causing a small number of grains to get stuck in an unbootable state.
- Oasis: Fixed related bug that caused grains created in the last few weeks to consume many more megabytes in a user's total storage quota than the actual size of the grain as reported in the top bar. If you feel that your total storage usage is being misreported, please try opening each of your grains created in the last three weeks to trigger a recount.

- Massively improved performance of `spk dev` filesystem tracing.
- Fixed that an app's SandstormCore capability could get disconnected if the frontend restarted without restarting the app, leaving the app in a state where certain features (especially powerbox-related) did not work.
- Fixed that clicking the clipboard button to copy an offer template would include extra whitespace on Firefox, which was especially bad when copying passwords e.g. from Davros.
- Stop printing spurrious warning about missing iptables module that just confused everyone.
- Sandstorm for Work: LDAP and SAML users ID cards will now show LDAP/SAML icon.
- Oasis: Increased file descriptor limits to improve reliability.

- Self-hosting: New, beautiful first-time setup wizard. (Sadly, if you already have a server, you'll never see it. But a redesign of the full admin UI is coming soon.)
- Sandstorm for Work: Added ability to disallow sharing outside the organization, which also disallows guest accounts (since they only exist for external sharing purposes).

- Sandstorm for Work: Added support for SAML login.
- Sandstorm for Work: LDAP identities now have email addresses.
- Sandstorm for Work: Removed the option to specify an LDAP DN pattern in favor of the search query approach. DN patterns were going to create problems for future planned features and none of our users so far used the feature to our knowledge.
- Sharing emails are now sent under the name of the sharer, with their email address specified in reply-to.
- Fixed several display bugs in Internet Explorer.
- Fixed that opening your own sharing link would sometimes prompt you to choose incognito mode.
- Fixed regression causing some popup windows to display partially-off-screen on mobile.
- Fixed minor display bugs with first-time usage tips on IE and Firefox.

- Remove chatty console.log() recently added for debugging. Oops.

- Apps can now verify a user's email address via a Powerbox interaction.
- Apps can now more easily tell when multiple sessions originate from the same grain tab (e.g. because the user closed their laptop and then opened it later and continued using the tab). Previously the app had to save a cookie to do this, but now Sandstorm will give it a `tabId`.
- Sandstorm will now warn you in the admin panel if Websockets aren't working, which tends to break many apps.
- The Picker Powerbox's query format has changed. Queries are now specified as base64-packed-capnp rather than JSON. This is necessary since the Sandstorm system does not necessarily know the schema of these descriptors and so won't be able to perform a JSON->capnp translation itself.
- Fixed a refresh loop that could occur when visiting a sharing link that had been revoked.
- Fixed some email deliverability issues. (Envelope sender was not always being set correctly.)
- Self-hosting: Fixed possible (but obscure) exception during startup migrations introduced in 0.151.
- Sandstorm for Work: Fixed "LDAP Search Username Field" not saving.