Tools that do an automatic fetch defeat "git push --force-with-lease"

When I'm rewriting history, "git push --force-with-lease" is a nice safeguard compared to "git push --force", but it still assumes the remote-tracking ref gives the old state the user wants to overwrite. Tools that do an implicit fetch, assuming it to be a safe operation, may break this assumption. In the worst case, Visual Studio Code does an automatic fetch every 3 minutes by default [1], making --force-with-lease pretty much reduce to --force.

For a safer workflow, "git push" would check against a separate "old" ref that isn't updated by "git fetch", but is updated by "git push" the same way the remote-tracking ref is and maybe also by commands that update the local branch to take into account remote changes (I'm not sure what reasonable scenarios there are, if any). Has there been any work on this? I can write a wrapper script for the simple case of "git push" of a single branch to the same branch on a remote, which is pretty much all I use right now, but a native implementation would support all of the command-line usage forms, which would be nice.

Thanks for reading!

[1] https://github.com/Microsoft/vscode/blob/535a3de60023c81d75d0eac22044284f07dbcddf/extensions/git/src/autofetch.ts

Matt