Function guard_network_exposure 

pub fn guard_network_exposure(
    bind_addr: &str,
    accepted: bool,
) -> Result<(), SshCliError>

Rejects a non-loopback bind unless the caller explicitly accepted the risk.

Pure and side-effect free so the policy is unit-testable without a socket.

Errors

SshCliError::InvalidArgument (exit 64) when the address is routable and accepted is false, or when the address cannot be parsed.