diff --git a/src/main/java/com/google/devtools/build/lib/cmdline/LabelValidator.java b/src/main/java/com/google/devtools/build/lib/cmdline/LabelValidator.java
index a2f419e..633946c 100644
--- a/src/main/java/com/google/devtools/build/lib/cmdline/LabelValidator.java
+++ b/src/main/java/com/google/devtools/build/lib/cmdline/LabelValidator.java
@@ -24,8 +24,14 @@
  */
 public final class LabelValidator {
 
+  // Target names allow all 7-bit ASCII characters except
+  // 0-31 (control characters)
+  // 58 ':' (colon)
+  // 92 '\' (backslash) - directory separator (on Windows); may be allowed in the future
+  // 127 (delete)
   /** Matches punctuation in target names which requires quoting in a blaze query. */
-  private static final CharMatcher PUNCTUATION_REQUIRING_QUOTING = CharMatcher.anyOf("+,=~# ()$");
+  private static final CharMatcher PUNCTUATION_REQUIRING_QUOTING =
+      CharMatcher.anyOf(" \"#$&'()*+,;<=>?[]{|}~");
 
   /**
    * Matches punctuation in target names which doesn't require quoting in a blaze query.
@@ -33,16 +39,21 @@
    * Note that . is also allowed in target names, and doesn't require quoting, but has restrictions
    * on its surrounding characters; see {@link #validateTargetName(String)}.
    */
-  private static final CharMatcher PUNCTUATION_NOT_REQUIRING_QUOTING = CharMatcher.anyOf("_@-");
+  private static final CharMatcher PUNCTUATION_NOT_REQUIRING_QUOTING =
+      CharMatcher.anyOf("!%-@^_`");
 
-  /**
-   * Matches characters allowed in package name.
-   */
+  // Package names allow all 7-bit ASCII characters except
+  // 0-31 (control characters)
+  // 58 ':' (colon) - target name separator
+  // 64 '@' (at-sign) - workspace name prefix
+  // 92 '\' (backslash) - directory separator (on Windows); may be allowed in the future
+  // 127 (delete)
+  /** Matches characters allowed in package name. */
   private static final CharMatcher ALLOWED_CHARACTERS_IN_PACKAGE_NAME =
       CharMatcher.inRange('0', '9')
           .or(CharMatcher.inRange('a', 'z'))
           .or(CharMatcher.inRange('A', 'Z'))
-          .or(CharMatcher.anyOf("/-._ $()"))
+          .or(CharMatcher.anyOf(" !\"#$%&'()*+,-./;<=>?[]^_`{|}~"))
           .precomputed();
 
   /**
@@ -59,7 +70,8 @@
 
   @VisibleForTesting
   static final String PACKAGE_NAME_ERROR =
-      "package names may contain only A-Z, a-z, 0-9, '/', '-', '.', ' ', '$', '(', ')' and '_'";
+      "package names may contain A-Z, a-z, 0-9, or any of ' !\"#$%&'()*+,-./;<=>?[]^_`{|}~'"
+          + " (most 127-bit ascii characters except 0-31, 127, ':', '@', or '\\')";
 
   @VisibleForTesting
   static final String PACKAGE_NAME_DOT_ERROR =
diff --git a/src/main/java/com/google/devtools/build/lib/packages/GlobCache.java b/src/main/java/com/google/devtools/build/lib/packages/GlobCache.java
index a486ddb..f9d885d 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/GlobCache.java
+++ b/src/main/java/com/google/devtools/build/lib/packages/GlobCache.java
@@ -174,6 +174,10 @@
       // invalid as a label, plus users should say explicitly if they
       // really want to name the package directory.
       if (!relative.isEmpty()) {
+        if (relative.charAt(0) == '@') {
+          // Add explicit colon to disambiguate from external repository.
+          relative = ":" + relative;
+        }
         result.add(relative);
       }
     }