@@ -25,6 +25,36 @@ import { IDialogService } from '../../../../platform/dialogs/common/dialogs.js';
 import { IHostService } from '../../host/browser/host.js';
 import { ExtensionGalleryAccountStatus, IExtensionGalleryAccountService } from '../common/extensionGalleryAccount.js';
 
+type ExtensionGalleryManifestResponse = Omit<IExtensionGalleryManifest, 'version' | 'capabilities'> & {
+	readonly version?: string;
+	readonly capabilities: Pick<IExtensionGalleryManifest['capabilities'], 'extensionQuery'>;
+};
+
+type ExtensionQueryCapabilityValue = NonNullable<IExtensionGalleryManifest['capabilities']['extensionQuery']['filtering']>[number];
+
+function isExtensionQueryCapabilityValue(candidate: unknown): candidate is ExtensionQueryCapabilityValue {
+	const value = candidate as Partial<ExtensionQueryCapabilityValue> | null;
+	return typeof value?.name === 'string' && typeof value.value === 'number';
+}
+
+function isExtensionQueryCapabilityValues(candidate: unknown): candidate is readonly ExtensionQueryCapabilityValue[] | undefined {
+	return candidate === undefined || (Array.isArray(candidate) && candidate.every(isExtensionQueryCapabilityValue));
+}
+
+function isExtensionGalleryManifestResponse(candidate: unknown): candidate is ExtensionGalleryManifestResponse {
+	const manifest = candidate as Partial<ExtensionGalleryManifestResponse> | null;
+	const extensionQuery = manifest?.capabilities?.extensionQuery;
+
+	return (manifest?.version === undefined || typeof manifest.version === 'string')
+		&& Array.isArray(manifest?.resources)
+		&& manifest.resources.every(resource => resource && typeof resource.id === 'string' && typeof resource.type === 'string')
+		&& typeof extensionQuery === 'object'
+		&& extensionQuery !== null
+		&& isExtensionQueryCapabilityValues(extensionQuery.filtering)
+		&& isExtensionQueryCapabilityValues(extensionQuery.sorting)
+		&& isExtensionQueryCapabilityValues(extensionQuery.flags);
+}
+
 export class WorkbenchExtensionGalleryManifestService extends ExtensionGalleryManifestService implements IExtensionGalleryManifestService {
 
 	private readonly commonHeadersPromise: Promise<IHeaders>;
@@ -211,13 +241,20 @@ export class WorkbenchExtensionGalleryManifestService extends ExtensionGalleryMa
 				callSite: 'extensionGalleryManifestService.fetchManifest'
 			}, CancellationToken.None);
 
-			const extensionGalleryManifest = await asJson<IExtensionGalleryManifest>(context);
+			const extensionGalleryManifest = await asJson<unknown>(context);
 
 			if (!extensionGalleryManifest) {
 				throw new Error('Unable to retrieve extension gallery manifest.');
 			}
 
-			return extensionGalleryManifest;
+			if (!isExtensionGalleryManifestResponse(extensionGalleryManifest)) {
+				throw new Error('Service index response is not a valid extension gallery manifest.');
+			}
+
+			return {
+				...extensionGalleryManifest,
+				version: extensionGalleryManifest.version ?? '',
+			};
 		} catch (error) {
 			this.logService.error('[Marketplace] Error retrieving extension gallery manifest', error);
 			throw error;
 
@@ -77,12 +77,13 @@ function createMicrosoftSession(accessToken = 'ms-token', accountId = 'ms-accoun
 	};
 }
 
-// Gallery manifest response stub. A well-formed manifest with an (empty) `resources` array is a
-// valid service index; eligibility is no longer discovered from a manifest resource.
 function createGalleryManifest() {
 	return {
 		version: '1.0',
 		resources: [],
+		capabilities: {
+			extensionQuery: {},
+		},
 	};
 }
 
@@ -413,6 +414,37 @@ suite('WorkbenchExtensionGalleryManifestService', () => {
 		assert.strictEqual(service.extensionGalleryManifestStatus, ExtensionGalleryManifestStatus.AccessDenied);
 	});
 
+	for (const [scenario, body] of [
+		['with a non-manifest body', { foo: 'bar' }],
+		['with malformed resources', { ...createGalleryManifest(), resources: [{}] }],
+		['without capabilities', { version: '1.0', resources: [] }],
+		['without the extensionQuery capability', { ...createGalleryManifest(), capabilities: {} }],
+		['with malformed extensionQuery capabilities', { ...createGalleryManifest(), capabilities: { extensionQuery: { filtering: [{}] } } }],
+	] as const) {
+		test(`GitHub provider — eligible account, 200 ${scenario} → AccessDenied`, async () => {
+			defaultAccount = createDefaultAccount({ enterprise: true });
+			requestHandler = () => mockResponse(200, body);
+
+			const service = createService();
+			await service.getExtensionGalleryManifest();
+
+			assert.strictEqual(service.extensionGalleryManifestStatus, ExtensionGalleryManifestStatus.AccessDenied);
+		});
+	}
+
+	test('GitHub provider — eligible account, 200 without a version → Available', async () => {
+		defaultAccount = createDefaultAccount({ enterprise: true });
+		requestHandler = () => mockResponse(200, { resources: [], capabilities: { extensionQuery: {} } });
+
+		const service = createService();
+		const manifest = await service.getExtensionGalleryManifest();
+
+		assert.deepStrictEqual(
+			{ status: service.extensionGalleryManifestStatus, version: manifest?.version },
+			{ status: ExtensionGalleryManifestStatus.Available, version: '' }
+		);
+	});
+
 	test('Microsoft provider — manifest fetch fails → AccessDenied', async () => {
 		configurationService.setUserConfiguration(ExtensionGalleryAuthProviderConfigKey, 'microsoft');
 		microsoftSessions = [createMicrosoftSession()];
@@ -688,7 +720,7 @@ suite('WorkbenchExtensionGalleryManifestService', () => {
 	test('Microsoft — switching to a different eligible account publishes that account catalog', async () => {
 		configurationService.setUserConfiguration(ExtensionGalleryAuthProviderConfigKey, 'microsoft');
 		microsoftSessions = [createMicrosoftSession('token-a', 'ms-account-1', 'ms-session-1')];
-		requestHandler = () => mockResponse(200, { version: '1.0', resources: [{ id: 'tenantA', type: 'ExtensionQueryService' }] });
+		requestHandler = () => mockResponse(200, { ...createGalleryManifest(), resources: [{ id: 'tenantA', type: 'ExtensionQueryService' }] });
 
 		const service = createService();
 		const first = await service.getExtensionGalleryManifest();
@@ -698,7 +730,7 @@ suite('WorkbenchExtensionGalleryManifestService', () => {
 		// A private marketplace is account-scoped, so a different eligible account can be served a
 		// different catalog. The already-available status must not suppress the new one.
 		microsoftSessions = [createMicrosoftSession('token-b', 'ms-account-2', 'ms-session-2')];
-		requestHandler = () => mockResponse(200, { version: '1.0', resources: [{ id: 'tenantB', type: 'ExtensionQueryService' }] });
+		requestHandler = () => mockResponse(200, { ...createGalleryManifest(), resources: [{ id: 'tenantB', type: 'ExtensionQueryService' }] });
 		onDidChangeSessions.fire({ providerId: 'microsoft', label: 'Microsoft', event: { added: [], removed: [], changed: [] } });
 		await new Promise(resolve => setTimeout(resolve, 0));