diff --git a/cmd/chat-cli/api/client.go b/cmd/chat-cli/api/client.go
index 6ff52db..66836ee 100644
--- a/cmd/chat-cli/api/client.go
+++ b/cmd/chat-cli/api/client.go
@@ -47,47 +47,6 @@ func NewClient(baseURL string) *Client {
 	}
 }
 
-func (c *Client) do(method, path string, body any) ([]byte, error) {
-	var bodyReader io.Reader
-
-	if body != nil {
-		data, err := json.Marshal(body)
-		if err != nil {
-			return nil, fmt.Errorf("marshal: %w", err)
-		}
-
-		bodyReader = bytes.NewReader(data)
-	}
-
-	req, err := http.NewRequestWithContext(context.Background(), method, c.BaseURL+path, bodyReader)
-	if err != nil {
-		return nil, fmt.Errorf("request: %w", err)
-	}
-
-	req.Header.Set("Content-Type", "application/json")
-
-	if c.Token != "" {
-		req.Header.Set("Authorization", "Bearer "+c.Token)
-	}
-
-	resp, err := c.HTTPClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("http: %w", err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	data, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("read body: %w", err)
-	}
-
-	if resp.StatusCode >= httpStatusErrorThreshold {
-		return data, fmt.Errorf("%w: %d: %s", ErrHTTPStatus, resp.StatusCode, string(data))
-	}
-
-	return data, nil
-}
-
 // CreateSession creates a new session on the server.
 func (c *Client) CreateSession(nick string) (*SessionResponse, error) {
 	data, err := c.do("POST", "/api/v1/session", &SessionRequest{Nick: nick})
@@ -258,3 +217,45 @@ func (c *Client) GetServerInfo() (*ServerInfo, error) {
 
 	return &info, nil
 }
+
+func (c *Client) do(method, path string, body any) ([]byte, error) {
+	var bodyReader io.Reader
+
+	if body != nil {
+		data, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal: %w", err)
+		}
+
+		bodyReader = bytes.NewReader(data)
+	}
+
+	req, err := http.NewRequestWithContext(context.Background(), method, c.BaseURL+path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	if c.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.Token)
+	}
+
+	resp, err := c.HTTPClient.Do(req) //nolint:gosec // URL constructed from trusted base URL
+	if err != nil {
+		return nil, fmt.Errorf("http: %w", err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("read body: %w", err)
+	}
+
+	if resp.StatusCode >= httpStatusErrorThreshold {
+		return data, fmt.Errorf("%w: %d: %s", ErrHTTPStatus, resp.StatusCode, string(data))
+	}
+
+	return data, nil
+}
diff --git a/cmd/chat-cli/ui.go b/cmd/chat-cli/ui.go
index a1c5dac..f044584 100644
--- a/cmd/chat-cli/ui.go
+++ b/cmd/chat-cli/ui.go
@@ -196,6 +196,22 @@ func (ui *UI) SetStatus(nick, target, connStatus string) {
 	})
 }
 
+// BufferCount returns the number of buffers.
+func (ui *UI) BufferCount() int {
+	return len(ui.buffers)
+}
+
+// BufferIndex returns the index of a named buffer, or -1.
+func (ui *UI) BufferIndex(name string) int {
+	for i, buf := range ui.buffers {
+		if buf.Name == name {
+			return i
+		}
+	}
+
+	return -1
+}
+
 func (ui *UI) refreshStatus() {
 	// Will be called from the main goroutine via QueueUpdateDraw parent.
 	// Rebuild status from app state — caller must provide context.
@@ -234,19 +250,3 @@ func (ui *UI) getOrCreateBuffer(name string) *Buffer {
 
 	return buf
 }
-
-// BufferCount returns the number of buffers.
-func (ui *UI) BufferCount() int {
-	return len(ui.buffers)
-}
-
-// BufferIndex returns the index of a named buffer, or -1.
-func (ui *UI) BufferIndex(name string) int {
-	for i, buf := range ui.buffers {
-		if buf.Name == name {
-			return i
-		}
-	}
-
-	return -1
-}