@newrelic/preflight 1.14.35 → 1.14.37

package/dist/metrics/git-efficiency-tracker.js

@@ -48,6 +48,10 @@ const GIT_DIFF_RE = /\bgit\s+diff\b/;
 const GIT_LOG_RE = /\bgit\s+log\b/;
 const GIT_COMMIT_RE = /\bgit\s+commit\b/;
 const GIT_WORKTREE_RE = /\bgit\s+worktree\b/;
+// Only `add`/`remove` create or tear down real isolation — `list`/`prune`/
+// `lock`/etc. are read-only inspection and shouldn't inflate the "worktree
+// ops" count with commands that don't reflect any parallel-isolation work.
+const GIT_WORKTREE_ADD_REMOVE_RE = /\bgit\s+worktree\s+(?:add|remove)\b/;
 const GIT_CHECKOUT_OURS_RE = /\bgit\s+checkout\s+--ours\b/;
 const GIT_CHECKOUT_THEIRS_RE = /\bgit\s+checkout\s+--theirs\b/;
 const GIT_CHERRY_PICK_RE = /\bgit\s+cherry-pick\b/;
@@ -61,6 +65,26 @@ const GH_PR_CHECKS_RE = /\bgh\s+pr\s+checks\b/;
 const GH_COMMAND_RE = /\bgh\s+/;
 // Extract PR number from gh commands
 const GH_PR_NUMBER_RE = /\bgh\s+pr\s+\w+\s+(\d+)/;
+// hydrateGitLog()'s dedup window, used only against a hook-observed commit
+// event (one with no hash in its command text): `git log`'s %ct has 1-second
+// resolution and a hook-observed commit event's timestamp is recorded when
+// the tool call completes, so the two timestamps for the same commit are
+// close but never exactly equal — and the hook event's command text is the
+// raw pre-execution shell string, which never contains the resulting hash,
+// so dedup against it can't key on a hash match. Treat any existing
+// hook-observed commit event within this window as the same commit.
+//
+// A hydrated commit ALWAYS carries a real hash from `git log`, so comparing
+// it against another hydrated event uses exact hash equality (via
+// HYDRATED_COMMIT_HASH_RE below) instead of this proximity window — two
+// genuinely distinct commits landing within the window (e.g. rapid
+// sequential commits in the same `git log` batch) must not collapse into
+// one just because their timestamps are close.
+const COMMIT_DEDUP_WINDOW_MS = 5_000;
+// Matches the synthetic command text hydrateGitLog() gives its own events
+// (see below), letting isDuplicate() tell a hydrated event apart from a
+// hook-observed one and recover its hash.
+const HYDRATED_COMMIT_HASH_RE = /^git commit \((.+)\)$/;
 const REJECT_INDICATORS = [
     /\[rejected\]/i,
     /non-fast-forward/i,
@@ -69,15 +93,27 @@ const REJECT_INDICATORS = [
 ];
 // Conflict file path extraction: "CONFLICT (content): Merge conflict in <path>"
 const CONFLICT_FILE_RE = /Merge conflict in (.+)/g;
+// Render order for suggestions/best-practices — most severe first — rather
+// than fixed source-code push order, which could put a critical item below
+// a milder one.
+const SUGGESTION_SEVERITY_RANK = {
+    critical: 0,
+    warning: 1,
+    info: 2,
+};
+const BEST_PRACTICE_STATUS_RANK = {
+    fail: 0,
+    warn: 1,
+    pass: 2,
+    unknown: 3,
+};
 // ---------------------------------------------------------------------------
 // Tracker
 // ---------------------------------------------------------------------------
 export class GitEfficiencyTracker {
     events = [];
     conflictRecords = [];
-    pendingConflictTimestamp = null;
-    pendingConflictCommand = '';
-    pendingConflictFiles = [];
+    pendingConflicts = [];
     lastSyncTimestamp = null;
     pullsSinceLastConflict = 0;
     consecutiveFailedPushes = 0;
@@ -93,9 +129,33 @@ export class GitEfficiencyTracker {
     editedFiles = new Set();
     hasUsedWorktree = false;
     hasUsedForceWithLease = false;
+    // Tracks whether ANY bare (non-lease) force-push occurred this session,
+    // independent of whether --force-with-lease was ever also used. This is
+    // the single shared signal both the force_with_lease best-practice check
+    // and the force_push suggestion's severity gate on, so the two checks
+    // agree on what counts as "was this session's force-push usage safe."
+    hasUsedBareForcePush = false;
+    // Count of bare (non-lease) force-pushes specifically — kept separate from
+    // stats.forcePushes (which sums bare AND lease-protected pushes) so
+    // severity scales with how much *unsafe* force-pushing happened, not with
+    // total force-push volume. A safe --force-with-lease push must never be
+    // able to escalate severity that a bare push alone already set.
+    bareForcePushCount = 0;
+    // Snapshot of whether any bare force-push landed while repoContext.branch
+    // matched repoContext.defaultBranch — a bare push to the shared default
+    // branch can clobber other collaborators' work, unlike an identical push
+    // to a personal feature branch only one person is using, so the two must
+    // not scale to the same severity.
+    hasForcePushedToDefaultBranch = false;
     totalToolCalls = 0;
     sessionStartTimestamp = null;
     commitTimestamps = [];
+    // Latest commit timestamp covered by a `hydrateGitLog()` call. A live
+    // `git commit` event with a timestamp at or before this is one `git log`
+    // already saw at hydration time — recordToolCall() must skip it rather
+    // than double-count a commit that's about to arrive (or already has)
+    // through the normal hook-observed path too. See recordToolCall().
+    hydratedThroughMs = 0;
     worktreeCommands = 0;
     oursCount = 0;
     theirsCount = 0;
@@ -107,7 +167,6 @@ export class GitEfficiencyTracker {
     commitsBehindMain = null;
     quickConflictResolutions = 0;
     prEvents = [];
-    firstCommitTimestamp = null;
     repoContext = {
         repoName: null,
         branch: null,
@@ -136,14 +195,31 @@ export class GitEfficiencyTracker {
         const command = record.command;
         if (!command)
             return;
-        // Track GitHub CLI PR commands (skip if `git commit` is the *command*, not
-        // text that happens to appear inside a gh argument like --title).
-        if (GH_COMMAND_RE.test(command) && !command.trimStart().startsWith('git ')) {
-            this.processGhCommand(command, record.timestamp);
+        // Track GitHub CLI PR commands. Split on shell separators first so a
+        // `gh` invocation chained after a `git` command (e.g. `git push && gh pr
+        // create --fill`) is still detected — checking the git-prefix guard
+        // against the whole compound string would skip it even though only the
+        // first segment is a `git` command. Each segment still skips the case
+        // where "gh" is just text inside a git argument, e.g. `git commit -m "gh
+        // pr create note"`.
+        for (const segment of command.split(/&&|;|\|/)) {
+            const trimmedSegment = segment.trim();
+            if (GH_COMMAND_RE.test(trimmedSegment) && !trimmedSegment.startsWith('git ')) {
+                this.processGhCommand(trimmedSegment, record.timestamp);
+            }
         }
         if (!GIT_COMMAND_RE.test(command))
             return;
         const event = this.classifyGitCommand(command, record);
+        // A hook-observed commit whose timestamp `hydrateGitLog()` already saw
+        // (via `git log`) is the same commit, not a new one — hydrateGitLog()
+        // can't dedupe this itself since a live event's `command` is the raw
+        // shell string, not `git commit (<hash>)`, so it never matches its own
+        // hash-based check. Without this, a day-boundary hydration followed by
+        // this same commit's hook event arriving from the same drain batch
+        // would count it twice.
+        if (event.type === 'commit' && event.timestamp <= this.hydratedThroughMs)
+            return;
         this.events.push(event);
         this.processEvent(event, command, record);
     }
@@ -181,14 +257,29 @@ export class GitEfficiencyTracker {
         const merged = this.prEvents.filter((e) => e.action === 'merge').length;
         const checksViewed = this.prEvents.filter((e) => e.action === 'checks').length;
         const prsUpdated = this.prEvents.filter((e) => e.action === 'edit' || e.action === 'ready').length;
-        // Time from first commit to first PR creation
-        let avgTimeToCreateMs = null;
-        if (created > 0 && this.firstCommitTimestamp !== null) {
-            const firstCreate = this.prEvents.find((e) => e.action === 'create');
-            if (firstCreate) {
-                avgTimeToCreateMs = Math.max(0, firstCreate.timestamp - this.firstCommitTimestamp);
+        // Time from each PR's most recent preceding commit to its `gh pr
+        // create`, averaged across every PR opened this session — not a single
+        // delta anchored to whichever commit happened to be the very first one
+        // this tracker ever saw, which would go stale after the first PR and
+        // ignore every PR opened later in the same session.
+        const sortedCommitTimestamps = [...this.commitTimestamps].sort((a, b) => a - b);
+        const timesToCreate = [];
+        for (const prEvent of this.prEvents) {
+            if (prEvent.action !== 'create')
+                continue;
+            let precedingCommitTimestamp = null;
+            for (const commitTimestamp of sortedCommitTimestamps) {
+                if (commitTimestamp > prEvent.timestamp)
+                    break;
+                precedingCommitTimestamp = commitTimestamp;
+            }
+            if (precedingCommitTimestamp !== null) {
+                timesToCreate.push(Math.max(0, prEvent.timestamp - precedingCommitTimestamp));
             }
         }
+        const avgTimeToCreateMs = timesToCreate.length > 0
+            ? timesToCreate.reduce((a, b) => a + b, 0) / timesToCreate.length
+            : null;
         return {
             created,
             merged,
@@ -209,17 +300,57 @@ export class GitEfficiencyTracker {
                 success: true,
                 durationMs: null,
             };
-            // Only add if we don't already have this commit tracked
-            const isDuplicate = this.events.some((e) => e.type === 'commit' && e.command?.includes(commit.hash));
+            // Only add if we don't already have this commit tracked. Against an
+            // existing hydrated event (one carrying its own real hash), match by
+            // exact hash equality — precise, and avoids collapsing two genuinely
+            // distinct commits that just happen to land within the proximity
+            // window. Against an existing hook-observed event, fall back to
+            // timestamp proximity: a prior session's hook-observed `commit` event,
+            // replayed via replayTimeline() before this method ever runs, has no
+            // hash in its command text at all, so a hash match would never catch
+            // it and every restart would double-count that commit.
+            const isDuplicate = this.events.some((e) => {
+                if (e.type !== 'commit')
+                    return false;
+                const existingHash = e.command ? HYDRATED_COMMIT_HASH_RE.exec(e.command)?.[1] : undefined;
+                if (existingHash !== undefined) {
+                    return existingHash === commit.hash;
+                }
+                return Math.abs(e.timestamp - commit.timestamp) < COMMIT_DEDUP_WINDOW_MS;
+            });
             if (!isDuplicate) {
                 this.events.push(event);
                 this.commitTimestamps.push(commit.timestamp);
                 // Don't increment commitsSinceLastSync for historical commits — this counter
                 // tracks real-time session activity, not replayed history.
             }
+            // Advance the watermark even for a commit that was already tracked —
+            // either way, `git log` has now vouched for everything up to here, so
+            // recordToolCall() must not add it again when the hook-observed event
+            // for it (still queued in the same drain batch) gets processed.
+            if (commit.timestamp > this.hydratedThroughMs) {
+                this.hydratedThroughMs = commit.timestamp;
+            }
         }
     }
-    replayTimeline(entries) {
+    /**
+     * @param repoName The replayed session's own repo (from `SessionSummary.repoName`).
+     *   When both this and the tracker's own `repoContext.repoName` (set via
+     *   `hydrateRepoContext()`) are known and they don't match, the whole
+     *   timeline is skipped — otherwise a session worked on in a
+     *   different repo earlier today would have its commits/conflicts/force-
+     *   pushes counted against whichever repo this process's header currently
+     *   names. When either side is unknown (null/undefined — e.g. no git
+     *   remote configured, or `repoContext` not hydrated yet), the timeline is
+     *   replayed unfiltered rather than risk dropping legitimate same-repo
+     *   history.
+     */
+    replayTimeline(entries, repoName) {
+        if (repoName != null &&
+            this.repoContext.repoName != null &&
+            repoName !== this.repoContext.repoName) {
+            return;
+        }
         for (const entry of entries) {
             const syntheticRecord = {
                 id: `replay-${entry.timestamp}`,
@@ -250,8 +381,27 @@ export class GitEfficiencyTracker {
         const pushCount = this.events.filter((e) => e.type === 'push' || e.type === 'force_push' || e.type === 'force_push_lease').length;
         const commitCount = this.events.filter((e) => e.type === 'commit').length;
         const branchOperations = this.events.filter((e) => e.type === 'branch').length;
-        const resolved = this.conflictRecords.filter((c) => c.resolution === 'resolved');
-        const conflictResolutionRate = this.conflictRecords.length > 0 ? resolved.length / this.conflictRecords.length : null;
+        // A conflict that's currently open (mid-merge, not yet aborted or
+        // resolved) is counted in the mergeConflicts/rebaseConflicts KPI above,
+        // but this.conflictRecords only gains an entry once it's aborted or
+        // resolved — so it would otherwise never enter the resolution-rate
+        // denominator, letting a session with one resolved and one still-open
+        // conflict show a "perfect" 100% rate. Synthesizing (not persisting) a
+        // 'pending' record per still-queued conflict keeps the denominator
+        // honest without ever double-counting once that conflict does resolve —
+        // at that point it leaves the queue and gets a real entry instead.
+        const allConflictRecords = [
+            ...this.conflictRecords,
+            ...this.pendingConflicts.map((p) => ({
+                timestamp: p.timestamp,
+                resolution: 'pending',
+                resolutionTimeMs: null,
+                command: p.command,
+                files: p.files,
+            })),
+        ];
+        const resolved = allConflictRecords.filter((c) => c.resolution === 'resolved');
+        const conflictResolutionRate = allConflictRecords.length > 0 ? resolved.length / allConflictRecords.length : null;
         const resolutionTimes = resolved
             .filter((c) => c.resolutionTimeMs !== null)
             .map((c) => c.resolutionTimeMs);
@@ -309,10 +459,21 @@ export class GitEfficiencyTracker {
             conflictResolutionRate,
             avgConflictResolutionMs,
             staleBranchPulls,
-            gitCommandTimeline: this.events.slice(-50),
-            conflictHistory: this.conflictRecords,
-            suggestions,
-            bestPractices,
+            // this.events/this.conflictRecords are append-only in processing
+            // order, not timestamp order — parallel tool calls within a session,
+            // or multi-session buffer draining, can push an earlier-timestamped
+            // event after a later one. Sort by timestamp ascending (oldest-first)
+            // before exposing, so gitCommandTimeline's consumer
+            // (GitEfficiency.tsx's `[...timeline].reverse().slice(0, 30)`) picks
+            // the true newest 30, not whichever 30 happened to be pushed last.
+            gitCommandTimeline: [...this.events].sort((a, b) => a.timestamp - b.timestamp).slice(-50),
+            conflictHistory: [...allConflictRecords].sort((a, b) => a.timestamp - b.timestamp),
+            // Both arrays render in whatever order the checks above happen to
+            // .push() in — fixed source-code order, not severity order — so a
+            // critical-severity item could render below a milder one. Sort by
+            // severity (most severe first) before exposing.
+            suggestions: [...suggestions].sort((a, b) => SUGGESTION_SEVERITY_RANK[a.severity] - SUGGESTION_SEVERITY_RANK[b.severity]),
+            bestPractices: [...bestPractices].sort((a, b) => BEST_PRACTICE_STATUS_RANK[a.status] - BEST_PRACTICE_STATUS_RANK[b.status]),
             preventionScore,
             efficiencyScore,
             riskIndicators,
@@ -325,9 +486,7 @@ export class GitEfficiencyTracker {
     reset(_sessionId) {
         this.events = [];
         this.conflictRecords = [];
-        this.pendingConflictTimestamp = null;
-        this.pendingConflictCommand = '';
-        this.pendingConflictFiles = [];
+        this.pendingConflicts = [];
         this.lastSyncTimestamp = null;
         this.pullsSinceLastConflict = 0;
         this.consecutiveFailedPushes = 0;
@@ -343,9 +502,13 @@ export class GitEfficiencyTracker {
         this.editedFiles.clear();
         this.hasUsedWorktree = false;
         this.hasUsedForceWithLease = false;
+        this.hasUsedBareForcePush = false;
+        this.bareForcePushCount = 0;
+        this.hasForcePushedToDefaultBranch = false;
         this.totalToolCalls = 0;
         this.sessionStartTimestamp = null;
         this.commitTimestamps = [];
+        this.hydratedThroughMs = 0;
         this.worktreeCommands = 0;
         this.oursCount = 0;
         this.theirsCount = 0;
@@ -357,7 +520,6 @@ export class GitEfficiencyTracker {
         this.commitsBehindMain = null;
         this.quickConflictResolutions = 0;
         this.prEvents = [];
-        this.firstCommitTimestamp = null;
         this.repoContext = { repoName: null, branch: null, remoteName: null, defaultBranch: null };
     }
     // -------------------------------------------------------------------------
@@ -425,18 +587,26 @@ export class GitEfficiencyTracker {
         return { ...base, type: 'other_git' };
     }
     processEvent(event, command, record) {
-        // Track conflict resolution strategies regardless of event type
-        if (GIT_CHECKOUT_OURS_RE.test(command))
-            this.oursCount++;
-        if (GIT_CHECKOUT_THEIRS_RE.test(command))
-            this.theirsCount++;
-        if (GIT_CHERRY_PICK_RE.test(command))
-            this.cherryPickCount++;
+        // Attribute ours/theirs/cherry-pick resolution strategy to the oldest
+        // still-open conflict, not to every matching command — a multi-file
+        // conflict resolved with one `--ours` per file must count once toward
+        // that conflict, not once per file, and a strategy command run with no
+        // conflict pending isn't resolving anything. `--abort` also matches the
+        // bare cherry-pick pattern, so it's excluded explicitly — aborting isn't
+        // a resolution strategy.
+        const oldestPending = this.pendingConflicts[0];
+        if (oldestPending) {
+            if (GIT_CHECKOUT_OURS_RE.test(command))
+                oldestPending.usedOurs = true;
+            if (GIT_CHECKOUT_THEIRS_RE.test(command))
+                oldestPending.usedTheirs = true;
+            if (GIT_CHERRY_PICK_RE.test(command) && !CHERRY_PICK_ABORT_RE.test(command)) {
+                oldestPending.usedCherryPick = true;
+            }
+        }
         switch (event.type) {
             case 'merge_conflict':
             case 'rebase_conflict': {
-                this.pendingConflictTimestamp = event.timestamp;
-                this.pendingConflictCommand = command;
                 const output = record.error ?? '';
                 const files = [];
                 let match;
@@ -445,56 +615,64 @@ export class GitEfficiencyTracker {
                     files.push(match[1].trim());
                     this.conflictedFiles.add(match[1].trim());
                 }
-                this.pendingConflictFiles = files;
+                this.pendingConflicts.push({
+                    timestamp: event.timestamp,
+                    command,
+                    files,
+                    usedOurs: false,
+                    usedTheirs: false,
+                    usedCherryPick: false,
+                });
                 this.pullsSinceLastConflict = 0;
                 break;
             }
             case 'merge_abort':
             case 'rebase_abort':
-            case 'cherry_pick_abort':
-                if (this.pendingConflictTimestamp !== null) {
+            case 'cherry_pick_abort': {
+                const pending = this.pendingConflicts.shift();
+                if (pending) {
                     this.conflictRecords.push({
-                        timestamp: this.pendingConflictTimestamp,
+                        timestamp: pending.timestamp,
                         resolution: 'aborted',
-                        resolutionTimeMs: event.timestamp - this.pendingConflictTimestamp,
-                        command: this.pendingConflictCommand,
-                        files: this.pendingConflictFiles,
+                        resolutionTimeMs: event.timestamp - pending.timestamp,
+                        command: pending.command,
+                        files: pending.files,
                     });
-                    this.pendingConflictTimestamp = null;
-                    this.pendingConflictCommand = '';
-                    this.pendingConflictFiles = [];
                 }
                 break;
+            }
             case 'commit': {
                 // git commit --amend fixes a prior commit, not a merge conflict.
-                // Clear the pending conflict on amend so the *next* normal commit
-                // doesn't see a stale pendingConflictTimestamp (potentially hours old).
+                // Drop the oldest pending conflict on amend (without recording a
+                // resolution) so a later, unrelated commit doesn't retroactively
+                // "resolve" it.
                 if (command.includes('--amend')) {
-                    this.pendingConflictTimestamp = null;
-                    this.pendingConflictCommand = '';
-                    this.pendingConflictFiles = [];
+                    this.pendingConflicts.shift();
                 }
-                if (this.pendingConflictTimestamp !== null && !command.includes('--amend')) {
-                    const resolutionMs = event.timestamp - this.pendingConflictTimestamp;
-                    this.conflictRecords.push({
-                        timestamp: this.pendingConflictTimestamp,
-                        resolution: 'resolved',
-                        resolutionTimeMs: resolutionMs,
-                        command: this.pendingConflictCommand,
-                        files: this.pendingConflictFiles,
-                    });
-                    // Under 30s resolution with multiple conflicted files is suspiciously fast
-                    if (resolutionMs < 30_000 && this.pendingConflictFiles.length > 1) {
-                        this.quickConflictResolutions++;
+                else {
+                    const pending = this.pendingConflicts.shift();
+                    if (pending) {
+                        const resolutionMs = event.timestamp - pending.timestamp;
+                        this.conflictRecords.push({
+                            timestamp: pending.timestamp,
+                            resolution: 'resolved',
+                            resolutionTimeMs: resolutionMs,
+                            command: pending.command,
+                            files: pending.files,
+                        });
+                        if (pending.usedOurs)
+                            this.oursCount++;
+                        if (pending.usedTheirs)
+                            this.theirsCount++;
+                        if (pending.usedCherryPick)
+                            this.cherryPickCount++;
+                        // Under 30s resolution with multiple conflicted files is suspiciously fast
+                        if (resolutionMs < 30_000 && pending.files.length > 1) {
+                            this.quickConflictResolutions++;
+                        }
                     }
-                    this.pendingConflictTimestamp = null;
-                    this.pendingConflictCommand = '';
-                    this.pendingConflictFiles = [];
                 }
                 this.commitTimestamps.push(event.timestamp);
-                if (this.firstCommitTimestamp === null) {
-                    this.firstCommitTimestamp = event.timestamp;
-                }
                 this.commitsSinceLastSync++;
                 this.statusChecksSinceLastAction = 0;
                 break;
@@ -535,6 +713,13 @@ export class GitEfficiencyTracker {
                 this.statusChecksSinceLastAction = 0;
                 break;
             case 'force_push':
+                this.hasUsedBareForcePush = true;
+                this.bareForcePushCount++;
+                if (this.repoContext.branch !== null &&
+                    this.repoContext.defaultBranch !== null &&
+                    this.repoContext.branch === this.repoContext.defaultBranch) {
+                    this.hasForcePushedToDefaultBranch = true;
+                }
                 if (this.lastPushRejectedTimestamp !== null &&
                     event.timestamp - this.lastPushRejectedTimestamp < 300_000) {
                     this.forceAfterReject++;
@@ -566,8 +751,14 @@ export class GitEfficiencyTracker {
                 this.statusChecksSinceLastAction = 0;
                 break;
             case 'worktree':
-                this.hasUsedWorktree = true;
-                this.worktreeCommands++;
+                // Both the "worktree ops" count and the usesWorktrees/use_worktrees
+                // signal are meant to reflect real worktree usage, not read-only
+                // inspection — `list`/`prune`/`lock`/etc. shouldn't count as evidence
+                // that worktrees were used to isolate parallel work.
+                if (GIT_WORKTREE_ADD_REMOVE_RE.test(command)) {
+                    this.worktreeCommands++;
+                    this.hasUsedWorktree = true;
+                }
                 break;
             case 'status':
                 this.statusChecksSinceLastAction++;
@@ -577,18 +768,24 @@ export class GitEfficiencyTracker {
                 break;
         }
     }
-    // A pull immediately followed by a conflict means the branch had already
-    // diverged enough that even the act of syncing produced a conflict — a
-    // stronger signal of a stale branch than a conflict from, say, a later
-    // merge or rebase attempted well after the pull.
+    // A pull that diverged enough to conflict is the strongest signal of a
+    // stale branch — checked directly off the conflicting event's own command
+    // (a `git pull` whose own output contains a conflict indicator classifies
+    // as merge_conflict/rebase_conflict, never as 'pull', so this can't rely
+    // on the event's `type`). A pull immediately followed by a *separate*
+    // command that then conflicts is a weaker but still real signal, kept as a
+    // fallback for events that don't match the direct case.
     countStaleBranchPulls() {
         let staleCount = 0;
-        for (let i = 0; i < this.events.length - 1; i++) {
-            if (this.events[i].type === 'pull') {
-                const next = this.events[i + 1];
-                if (next.type === 'merge_conflict' || next.type === 'rebase_conflict') {
-                    staleCount++;
-                }
+        for (let i = 0; i < this.events.length; i++) {
+            const event = this.events[i];
+            if (event.type !== 'merge_conflict' && event.type !== 'rebase_conflict')
+                continue;
+            if (GIT_PULL_RE.test(event.command ?? '')) {
+                staleCount++;
+            }
+            else if (i > 0 && this.events[i - 1].type === 'pull') {
+                staleCount++;
             }
         }
         return staleCount;
@@ -739,7 +936,12 @@ export class GitEfficiencyTracker {
                 detail: 'No worktree usage detected. Consider worktrees if you run parallel sessions.',
             });
         }
-        // 5. Use --force-with-lease instead of --force
+        // 5. Use --force-with-lease instead of --force. Gated on
+        // hasUsedBareForcePush rather than forcePushes/usesForceWithLease alone —
+        // those two count safe and unsafe force-pushes together, so checking
+        // usesForceWithLease alone would let one safe `--force-with-lease` mask a
+        // dangerous bare `--force` in the same session with a fully-passing
+        // status.
         if (stats.forcePushes === 0) {
             practices.push({
                 id: 'force_with_lease',
@@ -748,15 +950,15 @@ export class GitEfficiencyTracker {
                 detail: 'No force pushes yet.',
             });
         }
-        else if (risk.usesForceWithLease) {
+        else if (this.hasUsedBareForcePush && risk.usesForceWithLease) {
             practices.push({
                 id: 'force_with_lease',
                 label: 'Use --force-with-lease',
-                status: 'pass',
-                detail: "Good — using --force-with-lease which refuses to overwrite remote commits you haven't seen.",
+                status: 'warn',
+                detail: 'Mixed usage this session — some force pushes used --force-with-lease, but at least one bare --force (unsafe) push also occurred. Always use --force-with-lease; it refuses to push if someone else has pushed to the branch since your last fetch.',
             });
         }
-        else {
+        else if (this.hasUsedBareForcePush) {
             practices.push({
                 id: 'force_with_lease',
                 label: 'Use --force-with-lease',
@@ -764,24 +966,15 @@ export class GitEfficiencyTracker {
                 detail: 'Using bare --force instead of --force-with-lease. The --force-with-lease flag is a safety net: it refuses to push if someone else has pushed to the branch since your last fetch. Always prefer it.',
             });
         }
-        // 6. Don't force-push after a rejection without investigating
-        if (risk.forceAfterReject > 0) {
-            practices.push({
-                id: 'no_force_after_reject',
-                label: "Don't force-push after rejection",
-                status: 'fail',
-                detail: `Push was rejected ${risk.pushRejections} time(s) and then force-pushed ${risk.forceAfterReject} time(s). When a push is rejected, pull + rebase first to incorporate upstream changes. Force pushing after a rejection overwrites others' work.`,
-            });
-        }
-        else if (risk.pushRejections > 0) {
+        else {
             practices.push({
-                id: 'no_force_after_reject',
-                label: "Don't force-push after rejection",
+                id: 'force_with_lease',
+                label: 'Use --force-with-lease',
                 status: 'pass',
-                detail: 'Push was rejected but correctly handled without force pushing.',
+                detail: "Good — using --force-with-lease which refuses to overwrite remote commits you haven't seen.",
             });
         }
-        // 7. Keep PRs small (proxy: many commits without pushing)
+        // 6. Keep PRs small (proxy: many commits without pushing)
         if (risk.commitsSinceLastSync > 15) {
             practices.push({
                 id: 'small_increments',
@@ -798,7 +991,7 @@ export class GitEfficiencyTracker {
                 detail: 'Good — committing and syncing in small batches.',
             });
         }
-        // 8. Avoid editing hot files
+        // 7. Avoid editing hot files
         if (risk.hotFiles.length > 0) {
             practices.push({
                 id: 'avoid_hot_files',
@@ -807,7 +1000,7 @@ export class GitEfficiencyTracker {
                 detail: `Editing files that previously conflicted: ${risk.hotFiles.slice(0, 3).join(', ')}${risk.hotFiles.length > 3 ? ` (+${risk.hotFiles.length - 3} more)` : ''}. These are "hot" files with active upstream changes — edits here are likely to conflict again. Consider coordinating or waiting for upstream to stabilize.`,
             });
         }
-        // 9. Build/test before pushing
+        // 8. Build/test before pushing
         if (this.buildBeforePush === null && this.lastPushTimestamp === null) {
             practices.push({
                 id: 'verify_before_push',
@@ -852,22 +1045,14 @@ export class GitEfficiencyTracker {
     generateSuggestions(stats) {
         const suggestions = [];
         // --- Proactive prevention suggestions (fire BEFORE conflicts happen) ---
-        if (stats.riskIndicators.syncedBeforeEditing === false) {
-            suggestions.push({
-                severity: 'warning',
-                category: 'no_initial_sync',
-                message: 'Started editing without syncing first. Run `git fetch && git rebase origin/main` (or your target branch) at the start of every session. This single habit prevents the majority of AI-assisted coding conflicts.',
-                evidence: 'First file edit occurred before any git pull/fetch',
-            });
-        }
-        if (stats.riskIndicators.commitsSinceLastSync > 8) {
-            suggestions.push({
-                severity: 'warning',
-                category: 'drift_risk',
-                message: `${stats.riskIndicators.commitsSinceLastSync} commits without syncing. You're accumulating drift that will compound into painful conflicts. Run \`git fetch && git rebase origin/main\` now — smaller, frequent rebases are far easier than one large one later.`,
-                evidence: `${stats.riskIndicators.commitsSinceLastSync} commits since last pull/fetch/rebase`,
-            });
-        }
+        //
+        // syncedBeforeEditing, commitsSinceLastSync (drift), and hotFiles are
+        // ongoing-state conditions already surfaced as their own Best Practice
+        // checks (sync_before_edit, frequent_sync, avoid_hot_files) — duplicating
+        // them here as one-off suggestions rendered the same fact twice, with a
+        // conflicting severity in the hot-files case. Best Practices is their
+        // canonical home; only force-after-reject (a one-time, reactive event
+        // with actionable remediation) is kept as a suggestion.
         if (stats.riskIndicators.forceAfterReject > 0) {
             suggestions.push({
                 severity: 'critical',
@@ -876,14 +1061,6 @@ export class GitEfficiencyTracker {
                 evidence: `${stats.riskIndicators.forceAfterReject} force push(es) within 5 min of a rejection`,
             });
         }
-        if (stats.riskIndicators.hotFiles.length > 0) {
-            suggestions.push({
-                severity: 'info',
-                category: 'hot_files',
-                message: `You're editing files that previously conflicted (${stats.riskIndicators.hotFiles.slice(0, 3).join(', ')}). These likely have active upstream work. Consider: (1) rebasing immediately to get latest state, (2) coordinating with whoever else is touching these files, or (3) deferring changes until upstream settles.`,
-                evidence: `${stats.riskIndicators.hotFiles.length} previously-conflicted file(s) re-edited`,
-            });
-        }
         // --- Reactive suggestions (fire after problems occur) ---
         if (stats.mergeConflicts + stats.rebaseConflicts >= 3) {
             suggestions.push({
@@ -909,20 +1086,40 @@ export class GitEfficiencyTracker {
                 evidence: `${stats.abortedOperations} aborted operations`,
             });
         }
-        if (stats.forcePushes >= 2) {
+        // Severity is gated on hasUsedBareForcePush/bareForcePushCount — the same
+        // shared signal the force_with_lease best-practice check uses — rather
+        // than the raw forcePushes count, which sums bare AND lease-protected
+        // pushes together. Gating (and scaling) on the bare-only count keeps this
+        // suggestion's ranking consistent with the best-practice check: adding a
+        // safe --force-with-lease push on top of an existing bare push must never
+        // raise severity, since only the bare push is actually risky.
+        //
+        // A bare push to the shared default branch is escalated to 'critical'
+        // outright, regardless of count — it can clobber other collaborators'
+        // work, unlike an identical push to a personal feature branch (which
+        // still scales by count, as above).
+        if (this.hasUsedBareForcePush) {
             suggestions.push({
-                severity: 'critical',
+                severity: this.hasForcePushedToDefaultBranch
+                    ? 'critical'
+                    : this.bareForcePushCount >= 2
+                        ? 'critical'
+                        : 'warning',
                 category: 'force_push',
-                message: 'Multiple force pushes this session. Always use --force-with-lease as a safety net. If you need to rewrite history, coordinate with collaborators first and ensure your local refs are up to date with `git fetch` before force pushing.',
-                evidence: `${stats.forcePushes} force pushes this session`,
+                message: this.hasForcePushedToDefaultBranch
+                    ? `Bare --force push used on the shared default branch (${this.repoContext.defaultBranch ?? 'default branch'}) — this can overwrite history other collaborators are building on. Always use --force-with-lease, and avoid force-pushing the default branch entirely if possible.`
+                    : 'Bare --force push used. Always use --force-with-lease instead — it refuses to push if someone else has pushed to the branch since your last fetch. If you need to rewrite history, coordinate with collaborators first and ensure your local refs are up to date with `git fetch` before force pushing.',
+                evidence: this.hasForcePushedToDefaultBranch
+                    ? `${this.bareForcePushCount} bare --force push(es) this session, including at least one on the default branch`
+                    : `${this.bareForcePushCount} bare --force push(es) this session`,
             });
         }
-        else if (stats.forcePushes === 1) {
+        else if (stats.riskIndicators.usesForceWithLease && stats.forcePushes >= 2) {
             suggestions.push({
                 severity: 'info',
                 category: 'force_push',
-                message: "Force push used. Prefer --force-with-lease for safer force pushes — it refuses to overwrite commits you haven't seen locally.",
-                evidence: '1 force push',
+                message: 'Multiple force pushes this session, all using --force-with-lease — the safe pattern. Repeated history rewrites can still be worth a second look if they indicate a workflow issue upstream.',
+                evidence: `${stats.forcePushes} lease-protected force pushes this session`,
             });
         }
         if (stats.resetHards >= 2) {
@@ -1076,15 +1273,16 @@ export class GitEfficiencyTracker {
         };
     }
     computeConflictStrategy() {
-        const manualMergeCount = this.conflictRecords.filter((c) => c.resolution === 'resolved').length -
+        const manualMergeCount = Math.max(0, this.conflictRecords.filter((c) => c.resolution === 'resolved').length -
             this.oursCount -
-            this.theirsCount;
+            this.theirsCount -
+            this.cherryPickCount);
         return {
             oursCount: this.oursCount,
             theirsCount: this.theirsCount,
-            manualMergeCount: Math.max(0, manualMergeCount),
+            manualMergeCount,
             cherryPickCount: this.cherryPickCount,
-            totalResolutions: this.oursCount + this.theirsCount + Math.max(0, manualMergeCount),
+            totalResolutions: this.oursCount + this.theirsCount + this.cherryPickCount + manualMergeCount,
         };
     }
 }