ssh-agent: improve handling of SSH_AUTH_SOCK variable

Specifically, only preserve `$SSH_AUTH_SOCK` when it points to a
forwarded agent.

modules/services/ssh-agent.nix

@@ -57,31 +57,33 @@ in
               else
                 "$XDG_RUNTIME_DIR/${cfg.socket}";
 
+            # Preserve $SSH_AUTH_SOCK only if it stems from a forwarded agent,
+            # which is the case if both $SSH_AUTH_SOCK and $SSH_CONNECTION are
+            # set.
             bashIntegration = ''
-              if [ -z "$SSH_AUTH_SOCK" ]; then
+              if [ -z "$SSH_AUTH_SOCK" -o -z "$SSH_CONNECTION" ]; then
                 export SSH_AUTH_SOCK=${socketPath}
               fi
             '';
-
             fishIntegration = ''
-              if test -z "$SSH_AUTH_SOCK"
+              if test -z "$SSH_AUTH_SOCK"; or test -z "$SSH_CONNECTION"
                 set -x SSH_AUTH_SOCK ${socketPath}
               end
             '';
-
             nushellIntegration =
-              if pkgs.stdenv.isDarwin then
+              let
-                ''
+                unsetOrEmpty = var: ''("${var}" not-in $env) or ($env.${var} | is-empty)'';
-                  if "SSH_AUTH_SOCK" not-in $env {
+                socketPath =
-                    $env.SSH_AUTH_SOCK = $"(${lib.getExe pkgs.getconf} DARWIN_USER_TEMP_DIR)/${cfg.socket}"
+                  if pkgs.stdenv.isDarwin then
-                  }
+                    ''$"(${lib.getExe pkgs.getconf} DARWIN_USER_TEMP_DIR)/${cfg.socket}"''
-                ''
+                  else
-              else
+                    ''$"($env.XDG_RUNTIME_DIR)/${cfg.socket}"'';
-                ''
+              in
-                  if "SSH_AUTH_SOCK" not-in $env {
+              ''
-                    $env.SSH_AUTH_SOCK = $"($env.XDG_RUNTIME_DIR)/${cfg.socket}"
+                if ${unsetOrEmpty "SSH_AUTH_SOCK"} or ${unsetOrEmpty "SSH_CONNECTION"} {
-                  }
+                  $env.SSH_AUTH_SOCK = ${socketPath}
-                '';
+                }
+              '';
           in
           {
             # $SSH_AUTH_SOCK has to be set early since other tools rely on it