groups list 400 INVALID_ARGUMENT: searchTransitiveGroups rejects `(A || B)` OR label filter

Environment

• gog version: v0.38.1 (324f656a 2026-08-26T04:37:04Z)
• Auth: delegated service account (domain-wide delegation), invoked as --account <workspace-email>

Repro

gog --account admin@example.com groups list

Result:

Google API error (400 badRequest): Request contains an invalid argument.

Root cause

internal/cmd/groups.go → searchTransitiveGroupsQuery builds this query:

return fmt.Sprintf(
    "member_key_id == '%s' && ('%s' in labels || '%s' in labels)",
    memberKeyID,
    groupLabelDiscussionForum, // cloudidentity.googleapis.com/groups.discussion_forum
    groupLabelDynamic,         // cloudidentity.googleapis.com/groups.dynamic
)

Cloud Identity's groups.memberships.searchTransitiveGroups query accepts && (AND) filters, but the parenthesized || (OR) between two label conditions is rejected with 400 INVALID_ARGUMENT.

Evidence (raw API, varying the query)

Suggested fix

Use a single label filter instead of the OR (e.g. only discussion_forum), or issue two separate queries and merge results. The two-label OR appears to have been introduced by the label-filter change (#315), but the OR form is not accepted by the Cloud Identity API.

Start in internal/cmd/groups.go at searchTransitiveGroupsQuery and reproduce with gog --account admin@example.com groups list. Check the Cloud Identity query constraints and choose between a single supported label filter or two queries with merged results. Done means the groups list request no longer returns 400 INVALID_ARGUMENT and still finds the intended groups.