fix: prevent connecting to own instance as a remote

Add shared isSelfOrigin() helper that normalizes origins before
comparing to window.location.origin. Fixes auto-connect treating
self-referencing replicatedInstances entries as remote connections,
causing duplicate friends/DMs/data. Also hides self-referencing
entries from the Connections panel UI.

packages/web/src/components/modals/ConnectedInstances.tsx

@@ -1,7 +1,7 @@
 import React, { useState } from 'react';
 import ReactDOM from 'react-dom';
 import type { InstanceInfoResponse, FederationRegistryEntry } from '@backspace/shared';
-import { useInstanceStore, DifferentPasswordError } from '../../stores/instanceStore';
+import { useInstanceStore, DifferentPasswordError, isSelfOrigin } from '../../stores/instanceStore';
 import { useAuthStore } from '../../stores/authStore';
 import { useUIStore } from '../../stores/uiStore';
 import { isElectron } from '../../platform/platform';
@@ -991,8 +991,9 @@ export function ConnectedInstances() {
     });
   };
 
-  // Convert registry Map to array
-  const registryEntries = Array.from(registry.values());
+  // Convert registry Map to array (hide self-referencing entry — shown as Home Instance above)
+  const registryEntries = Array.from(registry.values())
+    .filter(entry => !isSelfOrigin(entry.origin));
 
   // Compute filter counts
   const counts = {

packages/web/src/stores/instanceStore.ts

@@ -116,6 +116,15 @@ function normalizeOrigin(url: string): string {
   }
 }
 
+/** Check whether an origin string refers to the current (home) instance. */
+export function isSelfOrigin(origin: string): boolean {
+  try {
+    return normalizeOrigin(origin) === window.location.origin;
+  } catch {
+    return false;
+  }
+}
+
 // ─── API client resolution ───────────────────────────────────────────────────
 
 // ─── Registry helpers ────────────────────────────────────────────────────────
@@ -187,8 +196,8 @@ export const useInstanceStore = create<InstanceState>((set, get) => ({
     const origin = normalizeOrigin(url);
 
     // Reject self-connection
-    if (origin === window.location.origin) {
-      throw new Error('Cannot add your home instance as a remote instance');
+    if (isSelfOrigin(url)) {
+      throw new Error("You're already logged into this instance");
     }
 
     // Reject duplicates
@@ -791,7 +800,7 @@ export const useInstanceStore = create<InstanceState>((set, get) => ({
     for (const ri of currentUser.replicatedInstances) {
       const origin = ri.origin || `https://${ri.domain}`;
       // Never connect to ourselves — home WS is managed separately
-      if (origin === window.location.origin) continue;
+      if (isSelfOrigin(origin)) continue;
       if (get().instances.some(i => i.origin === origin)) continue; // already loaded
       const cachedEntry = cached[origin];
       const regEntry = registry.get(origin);