diff --git a/src/webdav.ts b/src/webdav.ts
index 38db58a..d35c49c 100644
--- a/src/webdav.ts
+++ b/src/webdav.ts
@@ -136,7 +136,7 @@ export function buildQuotaBody(): string {
 }
 
 /** SEARCH request generica (rfc5323) — costruisce dinamicamente il where-clause */
-export function buildSearchRequest(options: SearchOptions): string {
+export function buildSearchRequest(options: SearchOptions, username: string): string {
   const filters: string[] = [];
 
   if (options.query) {
@@ -193,13 +193,21 @@ export function buildSearchRequest(options: SearchOptions): string {
     whereClause = `  <d:where>\n    <d:and>\n${filters.join("\n")}\n    </d:and>\n  </d:where>`;
   }
 
-  const scopePath = normalizePath(options.path || "/");
-  const scope = `/files/${escapeXml(scopePath)}`;
+  const scopePath = normalizePath(options.path || "/").replace(/^\//, "");
+  const scope = `/files/${escapeXml(username)}/${escapeXml(scopePath)}`;
 
-  const orderby = options.sortBy
+  const SORT_PROPERTY_MAP: Record<string, string> = {
+    name: "displayname",
+    size: "oc:size",
+    lastModified: "getlastmodified",
+    created: "nc:creation_time",
+    favorite: "oc:favorite",
+  };
+  const sortProp = options.sortBy ? SORT_PROPERTY_MAP[options.sortBy] || `d:${escapeXml(options.sortBy)}` : null;
+  const orderby = sortProp
     ? `  <d:orderby>
     <d:order>
-      <d:prop><d:${escapeXml(options.sortBy)} /></d:prop>
+      <d:prop><${sortProp} /></d:prop>
       <d:${options.sortOrder === "desc" ? "descending" : "ascending"} />
     </d:order>
   </d:orderby>`
@@ -427,9 +435,16 @@ function decodeXmlText(value: string): string {
 
 function resolveRelativePathFromHref(href: string, basePath: string): string {
   const decoded = decodeURIComponent(href);
-  // basePath is like /remote.php/dav/files/user/
-  if (decoded.startsWith(basePath)) {
-    return decoded.slice(basePath.length) || "/";
+
+  // Extract username from href: /remote.php/dav/files/{username}/...
+  const match = decoded.match(/^\/remote\.php\/dav\/files\/([^\/]+)/);
+  if (!match) return decoded;
+
+  const username = match[1];
+  const davBase = `/remote.php/dav/files/${username}`;
+
+  if (decoded.startsWith(davBase)) {
+    return decoded.slice(davBase.length) || "/";
   }
   return decoded;
 }