Hi, Jonathan. Profiles and permission sets are....special. When you retrieve them, you also need to retrieve the other metadata that they authorize, e.g., objects/fields, classes/pages, etc., or they come back sparsely-populated based on the other items in the retrieval request. I recommend that you use
Retrieve Metadata, select the profiles/permission sets and the things they authorize, then do a
Retrieve for Merge and only copy the retrieved profiles/permission sets into your local project.
I should probably add this to the FAQ as it's not at all intuitive and it's just the way that these metadata types work when doing a metadata API retrieve.
Please let me know if that doesn't help you.
Regards,
Scott Wells