Bug: Permission patterns with :* suffix don't match commands with no arguments

Description

Permission patterns using the :* suffix (e.g., Bash(.madt/bin/*:*)) don't match commands that are run without arguments.

Steps to Reproduce

1. Add permission pattern: "Bash(.madt/bin/*:*)"
2. Run a command with no arguments: .madt/bin/session-greeting
3. Claude Code prompts for approval despite the pattern

Expected Behavior

Bash(.madt/bin/*:*) should match .madt/bin/session-greeting (no arguments) because * typically matches zero or more characters, including empty string.

Actual Behavior

The command requires manual approval. Users must add BOTH patterns:

• "Bash(.madt/bin/*:*)" - for commands with arguments
• "Bash(.madt/bin/*)" - for commands without arguments

Additional Observations

1. Glob patterns don't recurse: Bash(.madt/*:*) does NOT match .madt/bin/something - the * only matches one path level, unlike ** in standard glob syntax.

1. This forces verbose permission configs with many redundant patterns.

Environment

• Claude Code CLI (latest)
• macOS Darwin 25.2.0

Suggested Fix

Either:

1. Make :* match zero or more arguments (including none)
2. Document that :* requires at least one argument, and users need both patterns
3. Support ** for recursive path matching in permissions

Workaround

Add both pattern variants:

"Bash(.madt/bin/*:*)",
"Bash(.madt/bin/*)",
"Bash(.madt/bin/session-greeting:*)",
"Bash(.madt/bin/session-greeting)"