search for: ssh_auth_sock_forward

I know this is pretty left-field, but I'm working on a custom ssh-agent implementation and looking at ways to detect forwarded agent connections, with the hope to have a "confirm" mode which can apply just to those (or those, plus non-whitelisted local processes). I realise this has been discussed a bit before, but I have thought up a method which seems to be working in my tests