Display warning when the agent is run in PowerShell Core

src/Agent.Listener/Agent.cs

@@ -19,6 +19,9 @@
 using Microsoft.VisualStudio.Services.Agent.Listener.Telemetry;
 using System.Collections.Generic;
 using Newtonsoft.Json;
+using Agent.Sdk.Knob;
+using Agent.Sdk.Util.ParentProcessUtil;
+using System.Diagnostics;
 
 namespace Microsoft.VisualStudio.Services.Agent.Listener
 {
@@ -326,6 +329,18 @@ private async Task<int> RunAsync(AgentSettings settings, bool runOnce = false)
             try
             {
                 Trace.Info(nameof(RunAsync));
+
+                if (AgentKnobs.CheckIfAgentIsRunningInPowershell.GetValue(HostContext).AsBoolean())
+                {
+                    bool useInteropKnob = AgentKnobs.UseInteropToFindParentProcess.GetValue(HostContext).AsBoolean();
+                    (bool isRunningInPwsh, _) = WindowsParentProcessUtil.IsParentProcess(useInteropKnob, ParentProcessNames.Pwsh);
+
+                    if (isRunningInPwsh)
+                    {
+                        _term.WriteLine(StringUtil.Loc("AgentRunningInPowerShellCore"));
+                    }
+                }
+
                 _listener = HostContext.GetService<IMessageListener>();
                 if (!await _listener.CreateSessionAsync(HostContext.AgentShutdownToken))
                 {

src/Agent.Sdk/Knob/AgentKnobs.cs

@@ -681,7 +681,6 @@ public class AgentKnobs
         public static readonly Knob UseInteropToFindParentProcess = new Knob(
             nameof(UseInteropToFindParentProcess),
             "Uses native Windows function to find parent processes of a process.",
-            new RuntimeKnobSource("AZP_AGENT_USE_INTEROP_TO_FIND_PARENT_PROCESS"),
             new EnvironmentKnobSource("AZP_AGENT_USE_INTEROP_TO_FIND_PARENT_PROCESS"),
             new BuiltInDefaultKnobSource("false"));
 
@@ -705,5 +704,11 @@ public class AgentKnobs
             new EnvironmentKnobSource("ROSETTA2_WARNING"),
             new PipelineFeatureSource("Rosetta2Warning"),
             new BuiltInDefaultKnobSource("false"));
+
+        public static readonly Knob CheckIfAgentIsRunningInPowershell = new Knob(
+            nameof(CheckIfAgentIsRunningInPowershell),
+            "Checks if the agent process is started from PowerShell.",
+            new EnvironmentKnobSource("AZP_AGENT_CHECK_IF_AGENT_IS_RUNNING_IN_POWERSHELL"),
+            new BuiltInDefaultKnobSource("false"));
     }
 }

src/Agent.Sdk/Util/ParentProcessUtil/InteropParentProcessFinder.cs

@@ -0,0 +1,87 @@
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+
+namespace Agent.Sdk.Util.ParentProcessUtil
+{
+    internal class Interop
+    {
+        [StructLayout(LayoutKind.Sequential)]
+        internal struct PROCESS_BASIC_INFORMATION
+        {
+            internal IntPtr ExitStatus;
+            internal IntPtr PebBaseAddress;
+            internal IntPtr AffinityMask;
+            internal IntPtr BasePriority;
+            internal IntPtr UniqueProcessId;
+            internal IntPtr InheritedFromUniqueProcessId;
+        }
+
+        [DllImport("ntdll.dll", SetLastError = true)]
+        internal static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, out PROCESS_BASIC_INFORMATION processInformation, int processInformationLength, out int returnLength);
+    }
+
+    internal static class InteropParentProcessFinder
+    {
+        private const string ParentProcessState = nameof(ParentProcessState);
+
+        internal static int? GetParentProcessId(IntPtr handle)
+        {
+            Interop.PROCESS_BASIC_INFORMATION pbi;
+            int returnLength;
+            int status = Interop.NtQueryInformationProcess(handle, 0, out pbi, Marshal.SizeOf<Interop.PROCESS_BASIC_INFORMATION>(), out returnLength);
+
+            if (status != 0)
+            {
+                return null;
+            }
+
+            int parentProcessId = pbi.InheritedFromUniqueProcessId.ToInt32();
+
+            return parentProcessId;
+        }
+
+        internal static (Process process, Dictionary<string, string> telemetry) GetParentProcess(Process process)
+        {
+            var telemetry = new Dictionary<string, string>();
+
+            try
+            {
+                int? parentProcessId = GetParentProcessId(process.Handle);
+
+                if (parentProcessId == null)
+                {
+                    return (null, telemetry);
+                }
+
+                Process parentProcess = Process.GetProcessById(parentProcessId.Value);
+
+                if (parentProcess == null
+                    || parentProcess.StartTime > process.StartTime
+                    || parentProcess.HasExited)
+                {
+                    return (null, telemetry);
+                }
+
+                return (parentProcess, telemetry);
+            }
+            catch (ArgumentException)
+            {
+                telemetry.Add(ParentProcessState, "Invalid argument passed for GetProcessById when using interop");
+                return (null, telemetry);
+            }
+            catch (Win32Exception)
+            {
+                telemetry.Add(ParentProcessState, "Win32 exception: could not retrieve parent process using interop");
+                return (null, telemetry);
+            }
+            catch (Exception)
+            {
+                telemetry.Add(ParentProcessState, "Exception occurred while retrieving parent process using interop");
+                return (null, telemetry);
+            }
+        }
+    }
+}

src/Agent.Sdk/Util/ParentProcessUtil/WindowsParentProcessUtil.cs

@@ -0,0 +1,73 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+
+namespace Agent.Sdk.Util.ParentProcessUtil
+{
+    public enum ParentProcessNames { Pwsh, Powershell };
+
+    public static class WindowsParentProcessUtil
+    {
+        public static (bool, Dictionary<string, string>) IsParentProcess(bool useInteropToFindParentProcess, params ParentProcessNames[] processNames)
+        {
+            var processList = new List<Process>();
+
+            try
+            {
+                (processList, var telemetry) = GetProcessList(Process.GetCurrentProcess(), useInteropToFindParentProcess);
+
+                bool isProcessRunningInPowerShell = processList.Exists(process => IsProcessPowershell(process, processNames));
+
+                return (isProcessRunningInPowerShell, telemetry);
+            }
+            finally
+            {
+                foreach (var process in processList)
+                {
+                    process.Dispose();
+                }
+            }
+        }
+
+        internal static (List<Process>, Dictionary<string, string>) GetProcessList(Process process, bool useInterop)
+        {
+            var telemetry = new Dictionary<string, string>();
+            var processList = new List<Process>() { process };
+            const int maxSearchDepthForProcess = 10;
+
+            while (processList.Count < maxSearchDepthForProcess)
+            {
+                Process lastProcess = processList.Last();
+
+                (Process parentProcess, telemetry) = useInterop
+                    ? InteropParentProcessFinder.GetParentProcess(lastProcess)
+                    : WmiParentProcessFinder.GetParentProcess(lastProcess);
+
+                if (parentProcess == null)
+                {
+                    break;
+                }
+
+                processList.Add(parentProcess);
+            }
+
+            return (processList, telemetry);
+        }
+
+        private static bool IsProcessPowershell(Process process, params ParentProcessNames[] processNamesForSearch)
+        {
+            try
+            {
+                // Getting process name can throw.
+                string name = process.ProcessName.ToLower();
+
+                return Array.Exists(processNamesForSearch, enumValue => enumValue.ToString().ToLower() == name);
+            }
+            catch
+            {
+                return false;
+            }
+        }
+    }
+}

src/Agent.Sdk/Util/ParentProcessUtil/WmiParentProcessFinder.cs

@@ -0,0 +1,37 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Management;
+
+namespace Agent.Sdk.Util.ParentProcessUtil
+{
+    internal static class WmiParentProcessFinder
+    {
+        private const string ParentProcessState = nameof(ParentProcessState);
+
+        internal static (Process process, Dictionary<string, string> telemetry) GetParentProcess(Process currentProcess)
+        {
+            using var query = new ManagementObjectSearcher($"SELECT ParentProcessId FROM Win32_Process WHERE ProcessId={currentProcess.Id}");
+
+            using ManagementObject foundProcess = query.Get().OfType<ManagementObject>().FirstOrDefault();
+
+            if (foundProcess == null)
+            {
+                return (null, null);
+            }
+
+            try
+            {
+                var parentProcessId = (int)(uint)foundProcess["ParentProcessId"];
+
+                return (Process.GetProcessById(parentProcessId), null);
+            }
+            catch
+            {
+                return (null, new() { [ParentProcessState] = "Error occurred while trying to get parent process id via WMI" });
+            }
+        }
+    }
+}