Org difference view. Profile comparision is suggesting removing big blocks of the permissions.

[PawelWozniak]

Summary

Trying to use metadata tracking, but it shows wrong suggestions for conflict resolutions.

Steps To Reproduce:

1. Have in your repository profile file which was creating by downloading matedata with package.xml where classes, objects and profiles were included.
2. In the org. Modify any field permission or add field on any object to just force difference in profile file.
3. Org Difference retrive profile without classes context and suggest removing big portion of the profile file.
   See the scroll bar how much empty space is on the left. Red marked are changed values.

It also suggest to remove fields permissions.

Expected result

I see only real difference.
In given example 5 fields has been changed, 1 added and 1 removed.

Actual result

There is a huge difference suggested, which is not true.

Additional information

Feel free to attach a screenshot.

Salesforce Extension Version in VS Code:
66.8.0
Salesforce CLI Version:
@salesforce/cli/2.131.7 win32-x64 node-v24.15.0
OS and version:
Windows 11 25H2
VS Code version:
1.117
Most recent version of the extensions where this was working:
Never as this is new feature.

[svc-idee-bot]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[mshanemc]

yep, profiles are just big problems. Many people recommend putting them in your .forceignore and not dealing with them at all.

Another good option is "use permSets" and get all the class/object/field access out of profiles, but I know that's a bit of migration to complete.

What you're seeing is a metadata API problem...you only get stuff in the profile if you do a Profile retrieve that also retrieves those things (ex: classes, or objects/fields).

What do you think it should do...ignore profiles for diffs since we know they're sketchy?

[PawelWozniak]

Ignoring is not an option, I think. How to deploy then a proper profile if it is not updated?
Migrating everything to permission sets could be the option, but it is time-consuming and has zero business value, so it is hard to justify such a task.

It is a pity that source tracking, which is promoted form some time and now even more promoted with the last changes to the plugin is still missing some basic options.

In such case I don't have any other idea how it should work other than retrieving the full profile.

[mshanemc]

yeah, if the metadata API behaved better many things in like would suck less 😄

fyi you probably can't retrieve the full profile correctly unless you retrieve all the other metadata at the same time (might work on scratch orgs).