Make `Label#toString` return `@@`-prefixed labels

This change causes all labels in error messages, log output, Build Event Protocol, etc. to be prefixed with double-at (`@@`) if they are from non-main repos. This prevents cases where messages contain stuff like `the target @abc~1.0//:def is wrong` but the user can't do `bazel query @abc~1.0//:def` at all, since the actual target is `@@abc~1.0//:def`.

This required more test changes than expected as there have been many places in the codebase where we compare labels using some sort of string form (for example, toolchain types as automatic exec groups).

Fixes https://github.com/bazelbuild/bazel/issues/18543.

RELNOTES[INC]: All labels in Bazel error messages, log output, Build Event Protocol, etc. are now prefixed with double-at (`@@`) instead of single-at (`@`) where applicable, to properly denote that they contain canonical repo names.

PiperOrigin-RevId: 581287175
Change-Id: I1261ab14067bcf5d44cd140e5528b5da5916dc87
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/RuleConfiguredTargetBuilder.java b/src/main/java/com/google/devtools/build/lib/analysis/RuleConfiguredTargetBuilder.java
index dcc7d19..7365330 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/RuleConfiguredTargetBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/RuleConfiguredTargetBuilder.java
@@ -348,7 +348,7 @@
       Label rdeLabel =
           ruleContext.getRule().getRuleClassObject().getRuleDefinitionEnvironmentLabel();
       // only allow native and builtins to override transitive validation propagation
-      if (rdeLabel != null && !"@_builtins".equals(rdeLabel.getRepository().getNameWithAt())) {
+      if (rdeLabel != null && !rdeLabel.getRepository().getName().equals("_builtins")) {
         ruleContext.ruleError(rdeLabel + " cannot access the _transitive_validation private API");
         return;
       }
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/config/StarlarkDefinedConfigTransition.java b/src/main/java/com/google/devtools/build/lib/analysis/config/StarlarkDefinedConfigTransition.java
index 911c2e4..d392fef 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/config/StarlarkDefinedConfigTransition.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/config/StarlarkDefinedConfigTransition.java
@@ -120,9 +120,10 @@
     return packageContext;
   }
 
-  /** Which .bzl file defines this transition? */
-  public String parentLabel() {
-    return parentLabel.getCanonicalForm();
+  /** Is this transition the same one specified by --experimental_exec_config? */
+  public boolean matchesExecConfigFlag(String starlarkExecConfig) {
+    return starlarkExecConfig.contains(parentLabel.getPackageName())
+        && starlarkExecConfig.contains(parentLabel.getName());
   }
 
   /**
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/starlark/FunctionTransitionUtil.java b/src/main/java/com/google/devtools/build/lib/analysis/starlark/FunctionTransitionUtil.java
index 09427e7..3a6db90 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/starlark/FunctionTransitionUtil.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/starlark/FunctionTransitionUtil.java
@@ -144,10 +144,8 @@
       BuildOptions fromOptions, StarlarkDefinedConfigTransition starlarkTransition) {
     if (starlarkTransition == null
         || fromOptions.get(CoreOptions.class).starlarkExecConfig == null
-        || !fromOptions
-            .get(CoreOptions.class)
-            .starlarkExecConfig
-            .startsWith(starlarkTransition.parentLabel())) {
+        || !starlarkTransition.matchesExecConfigFlag(
+            fromOptions.get(CoreOptions.class).starlarkExecConfig)) {
       // Not an exec transition: the baseline options are just the input options.
       return fromOptions;
     }
@@ -471,7 +469,7 @@
     boolean isExecTransition =
         coreOptions.starlarkExecConfig != null
             && starlarkTransition != null
-            && coreOptions.starlarkExecConfig.startsWith(starlarkTransition.parentLabel());
+            && starlarkTransition.matchesExecConfigFlag(coreOptions.starlarkExecConfig);
 
     if (!isExecTransition
         && coreOptions.outputDirectoryNamingScheme.equals(
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/starlark/StarlarkRuleClassFunctions.java b/src/main/java/com/google/devtools/build/lib/analysis/starlark/StarlarkRuleClassFunctions.java
index 16e30a8..936faae 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/starlark/StarlarkRuleClassFunctions.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/starlark/StarlarkRuleClassFunctions.java
@@ -521,7 +521,7 @@
     // Verify the child against parent's allowlist
     if (parent != null
         && parent.getExtendableAllowlist() != null
-        && !bzlFile.getRepository().getNameWithAt().equals("@_builtins")) {
+        && !bzlFile.getRepository().getName().equals("_builtins")) {
       builder.addAllowlistChecker(EXTEND_RULE_ALLOWLIST_CHECKER);
       Attribute.Builder<Label> allowlistAttr =
           attr("$allowlist_extend_rule", LABEL)
@@ -705,7 +705,7 @@
       hasFunctionTransitionAllowlist = true;
     }
     if (hasStarlarkDefinedTransition) {
-      if (!bzlFile.getRepository().getNameWithAt().equals("@_builtins")) {
+      if (!bzlFile.getRepository().getName().equals("_builtins")) {
         if (!hasFunctionTransitionAllowlist) {
           // add the allowlist automatically
           builder.add(
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/cpp/BazelCppSemantics.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/cpp/BazelCppSemantics.java
index a6a4896..5e8aa74 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/cpp/BazelCppSemantics.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/cpp/BazelCppSemantics.java
@@ -71,7 +71,8 @@
     this.language = language;
   }
 
-  private static final String CPP_TOOLCHAIN_TYPE = "@bazel_tools//tools/cpp:toolchain_type";
+  private static final String CPP_TOOLCHAIN_TYPE =
+      Label.parseCanonicalUnchecked("@bazel_tools//tools/cpp:toolchain_type").toString();
 
   @Override
   public String getCppToolchainType() {
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BazelJavaSemantics.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BazelJavaSemantics.java
index 70f9b90..4a81f16 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BazelJavaSemantics.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/BazelJavaSemantics.java
@@ -79,10 +79,10 @@
   private static final String BAZEL_TEST_RUNNER_MAIN_CLASS =
       "com.google.testing.junit.runner.BazelTestRunner";
 
-  private BazelJavaSemantics() {
-  }
+  private BazelJavaSemantics() {}
 
-  private static final String JAVA_TOOLCHAIN_TYPE = "@bazel_tools//tools/jdk:toolchain_type";
+  private static final String JAVA_TOOLCHAIN_TYPE =
+      Label.parseCanonicalUnchecked("@bazel_tools//tools/jdk:toolchain_type").toString();
   private static final Label JAVA_RUNITME_TOOLCHAIN_TYPE =
       Label.parseCanonicalUnchecked("@bazel_tools//tools/jdk:runtime_toolchain_type");
 
diff --git a/src/main/java/com/google/devtools/build/lib/cmdline/Label.java b/src/main/java/com/google/devtools/build/lib/cmdline/Label.java
index 3a48e0b..82e3ed1 100644
--- a/src/main/java/com/google/devtools/build/lib/cmdline/Label.java
+++ b/src/main/java/com/google/devtools/build/lib/cmdline/Label.java
@@ -412,8 +412,6 @@
    *
    * <p>Unlike {@link #getDisplayForm}, this method elides the name part of the label if possible.
    *
-   * <p>Unlike {@link #toShorthandString}, this method respects {@link RepositoryMapping}.
-   *
    * @param mainRepositoryMapping the {@link RepositoryMapping} of the main repository
    */
   public String getShorthandDisplayForm(RepositoryMapping mainRepositoryMapping) {
@@ -444,27 +442,6 @@
   }
 
   /**
-   * Renders this label in shorthand form.
-   *
-   * <p>Labels with canonical form {@code //foo/bar:bar} have the shorthand form {@code //foo/bar}.
-   * All other labels have identical shorthand and canonical forms.
-   *
-   * <p>Unlike {@link #getShorthandDisplayForm}, this method does not respect repository mapping.
-   */
-  public String toShorthandString() {
-    if (!getPackageFragment().getBaseName().equals(name)) {
-      return toString();
-    }
-    String repository;
-    if (packageIdentifier.getRepository().isMain()) {
-      repository = "";
-    } else {
-      repository = packageIdentifier.getRepository().getNameWithAt();
-    }
-    return repository + "//" + getPackageFragment();
-  }
-
-  /**
    * Returns a label in the same package as this label with the given target name.
    *
    * @throws LabelSyntaxException if {@code targetName} is not a valid target name
diff --git a/src/main/java/com/google/devtools/build/lib/cmdline/PackageIdentifier.java b/src/main/java/com/google/devtools/build/lib/cmdline/PackageIdentifier.java
index fd1cf0f..a848ba5 100644
--- a/src/main/java/com/google/devtools/build/lib/cmdline/PackageIdentifier.java
+++ b/src/main/java/com/google/devtools/build/lib/cmdline/PackageIdentifier.java
@@ -195,7 +195,7 @@
    * package.
    */
   public String getUnambiguousCanonicalForm() {
-    return String.format("@%s//%s", repository.getNameWithAt(), pkgName);
+    return repository.getNameWithAt() + "//" + pkgName;
   }
 
   /**
@@ -216,7 +216,7 @@
    *           from the main module
    */
   public String getDisplayForm(RepositoryMapping mainRepositoryMapping) {
-    return String.format("%s//%s", repository.getDisplayForm(mainRepositoryMapping), pkgName);
+    return repository.getDisplayForm(mainRepositoryMapping) + "//" + pkgName;
   }
 
   @Override
diff --git a/src/main/java/com/google/devtools/build/lib/cmdline/RepositoryName.java b/src/main/java/com/google/devtools/build/lib/cmdline/RepositoryName.java
index 995e942..d0b0645 100644
--- a/src/main/java/com/google/devtools/build/lib/cmdline/RepositoryName.java
+++ b/src/main/java/com/google/devtools/build/lib/cmdline/RepositoryName.java
@@ -153,12 +153,12 @@
     // Some special cases for more user-friendly error messages.
     if (name.equals(".") || name.equals("..")) {
       throw LabelParser.syntaxErrorf(
-          "invalid repository name '@%s': repo names are not allowed to be '@%s'", name, name);
+          "invalid repository name '%s': repo names are not allowed to be '%s'", name, name);
     }
 
     if (!VALID_REPO_NAME.matcher(name).matches()) {
       throw LabelParser.syntaxErrorf(
-          "invalid repository name '@%s': repo names may contain only A-Z, a-z, 0-9, '-', '_', '.'"
+          "invalid repository name '%s': repo names may contain only A-Z, a-z, 0-9, '-', '_', '.'"
               + " and '~' and must not start with '~'",
           StringUtilities.sanitizeControlChars(name));
     }
@@ -203,7 +203,7 @@
     if (ownerRepoIfNotVisible.isMain()) {
       return "main repository";
     } else {
-      return String.format("repository '%s'", ownerRepoIfNotVisible.getNameWithAt());
+      return String.format("repository '%s'", ownerRepoIfNotVisible);
     }
   }
 
@@ -212,20 +212,23 @@
     return equals(MAIN);
   }
 
-  /** Returns the repository name, with leading "{@literal @}". */
+  /**
+   * Returns the repository name, with two leading "{@literal @}"s, indicating that this is a
+   * canonical repo name.
+   */
+  // TODO(bazel-team): Rename to "getCanonicalForm".
   public String getNameWithAt() {
     if (!isVisible()) {
-      return String.format(
-          "@[unknown repo '%s' requested from %s]", name, ownerRepoIfNotVisible.getNameWithAt());
+      return String.format("@@[unknown repo '%s' requested from %s]", name, ownerRepoIfNotVisible);
     }
-    return '@' + name;
+    return "@@" + name;
   }
 
   /**
-   * Returns the repository name with leading "{@literal @}" except for the main repo, which is just
-   * the empty string.
+   * Returns the repository name with leading "{@literal @}"s except for the main repo, which is
+   * just the empty string.
    */
-  // TODO(bazel-team): Consider renaming to "getDefaultForm".
+  // TODO(bazel-team): Rename to "getDefaultForm".
   public String getCanonicalForm() {
     return isMain() ? "" : getNameWithAt();
   }
@@ -252,7 +255,7 @@
     Preconditions.checkArgument(
         mainRepositoryMapping.ownerRepo() == null || mainRepositoryMapping.ownerRepo().isMain());
     if (!isVisible()) {
-      return '@' + getNameWithAt();
+      return getNameWithAt();
     }
     if (isMain()) {
       // Packages in the main repository can always use repo-relative form.
@@ -262,14 +265,14 @@
       // If the main repository mapping is not using strict visibility, then Bzlmod is certainly
       // disabled, which means that canonical and apparent names can be used interchangeably from
       // the context of the main repository.
-      return getNameWithAt();
+      return '@' + getName();
     }
     // If possible, represent the repository with a non-canonical label using the apparent name the
     // main repository has for it, otherwise fall back to a canonical label.
     return mainRepositoryMapping
         .getInverse(this)
         .map(apparentName -> "@" + apparentName)
-        .orElse("@" + getNameWithAt());
+        .orElse(getNameWithAt());
   }
 
   /**
@@ -300,7 +303,7 @@
         : PathFragment.create("..").getRelative(getName());
   }
 
-  /** Returns the repository name, with leading "{@literal @}". */
+  /** Same as {@link #getNameWithAt}. */
   @Override
   public String toString() {
     return getNameWithAt();
diff --git a/src/main/java/com/google/devtools/build/lib/packages/BuiltinRestriction.java b/src/main/java/com/google/devtools/build/lib/packages/BuiltinRestriction.java
index 87a26ae..407c89d 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/BuiltinRestriction.java
+++ b/src/main/java/com/google/devtools/build/lib/packages/BuiltinRestriction.java
@@ -40,7 +40,7 @@
    */
   public static void failIfCalledOutsideBuiltins(StarlarkThread thread) throws EvalException {
     Label currentFile = BazelModuleContext.ofInnermostBzlOrThrow(thread).label();
-    if (!currentFile.getRepository().getNameWithAt().equals("@_builtins")) {
+    if (!currentFile.getRepository().getName().equals("_builtins")) {
       throw Starlark.errorf(
           "file '%s' cannot use private @_builtins API", currentFile.getCanonicalForm());
     }
@@ -103,7 +103,7 @@
   public static void failIfLabelOutsideAllowlist(
       Label label, RepositoryMapping repoMapping, Collection<AllowlistEntry> allowlist)
       throws EvalException {
-    if (label.getRepository().getNameWithAt().equals("@_builtins")) {
+    if (label.getRepository().getName().equals("_builtins")) {
       return;
     }
     if (allowlist.stream().noneMatch(e -> e.allows(label, repoMapping))) {
diff --git a/src/main/java/com/google/devtools/build/lib/packages/StarlarkNativeModule.java b/src/main/java/com/google/devtools/build/lib/packages/StarlarkNativeModule.java
index 37c78f7..66fb2fa 100644
--- a/src/main/java/com/google/devtools/build/lib/packages/StarlarkNativeModule.java
+++ b/src/main/java/com/google/devtools/build/lib/packages/StarlarkNativeModule.java
@@ -618,7 +618,8 @@
     BazelStarlarkContext.checkLoadingPhase(thread, "native.repository_name");
     PackageIdentifier packageId =
         PackageFactory.getContext(thread).getBuilder().getPackageIdentifier();
-    return packageId.getRepository().getNameWithAt();
+    // for legacy reasons, this is prefixed with a single '@'.
+    return '@' + packageId.getRepository().getName();
   }
 
   @Override
diff --git a/src/main/java/com/google/devtools/build/lib/repository/RepositoryFetchProgress.java b/src/main/java/com/google/devtools/build/lib/repository/RepositoryFetchProgress.java
index 1d52b26..9ecd44a 100644
--- a/src/main/java/com/google/devtools/build/lib/repository/RepositoryFetchProgress.java
+++ b/src/main/java/com/google/devtools/build/lib/repository/RepositoryFetchProgress.java
@@ -24,7 +24,7 @@
 
   /** Returns the unique identifying string for a repository fetching event. */
   public static String repositoryFetchContextString(RepositoryName repoName) {
-    return "repository " + repoName.getNameWithAt();
+    return "repository " + repoName;
   }
 
   public static RepositoryFetchProgress ongoing(RepositoryName repoName, String message) {
diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcCommon.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcCommon.java
index 9b730ea..a8f1bde 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcCommon.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcCommon.java
@@ -785,7 +785,7 @@
 
     RuleClass ruleClass = rule.getRuleClassObject();
     Label label = ruleClass.getRuleDefinitionEnvironmentLabel();
-    if (label.getRepository().getNameWithAt().equals("@_builtins")) {
+    if (label.getRepository().getName().equals("_builtins")) {
       // always permit builtins
       return true;
     }
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaPluginsFlagAliasRule.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaPluginsFlagAliasRule.java
index cfee6b8..4171f8b 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaPluginsFlagAliasRule.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaPluginsFlagAliasRule.java
@@ -27,6 +27,7 @@
 import com.google.devtools.build.lib.analysis.RuleDefinitionEnvironment;
 import com.google.devtools.build.lib.analysis.RunfilesProvider;
 import com.google.devtools.build.lib.analysis.config.ExecutionTransitionFactory;
+import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.packages.RuleClass;
 import javax.annotation.Nullable;
 
@@ -37,9 +38,10 @@
  */
 public final class JavaPluginsFlagAliasRule implements RuleDefinition {
 
-  private static final ImmutableSet<String> ALLOWLISTED_LABELS =
+  private static final ImmutableSet<Label> ALLOWLISTED_LABELS =
       ImmutableSet.of(
-          "//tools/jdk:java_plugins_flag_alias", "@bazel_tools//tools/jdk:java_plugins_flag_alias");
+          Label.parseCanonicalUnchecked("//tools/jdk:java_plugins_flag_alias"),
+          Label.parseCanonicalUnchecked("@bazel_tools//tools/jdk:java_plugins_flag_alias"));
 
   @Override
   public RuleClass build(RuleClass.Builder builder, RuleDefinitionEnvironment environment) {
@@ -72,7 +74,7 @@
     public ConfiguredTarget create(RuleContext ruleContext)
         throws InterruptedException, RuleErrorException,
             MutableActionGraph.ActionConflictException {
-      if (!ALLOWLISTED_LABELS.contains(ruleContext.getLabel().getCanonicalForm())) {
+      if (!ALLOWLISTED_LABELS.contains(ruleContext.getLabel())) {
         ruleContext.ruleError("Rule " + ruleContext.getLabel() + " cannot use private rule");
         return null;
       }
diff --git a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
index 845c8b6..756476d 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
@@ -208,7 +208,7 @@
       throw new RepositoryFunctionException(
           new IOException(
               "to fix, run\n\tbazel fetch //...\nExternal repository "
-                  + repositoryName.getNameWithAt()
+                  + repositoryName
                   + " not found and fetching repositories is disabled."),
           Transience.TRANSIENT);
     }
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/BzlLoadCycleReporter.java b/src/main/java/com/google/devtools/build/lib/skyframe/BzlLoadCycleReporter.java
index aa5ec38..27a020f 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/BzlLoadCycleReporter.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/BzlLoadCycleReporter.java
@@ -139,7 +139,7 @@
       Function<Object, String> printer =
           input -> {
             if (input instanceof RepositoryDirectoryValue.Key) {
-              return ((RepositoryDirectoryValue.Key) input).argument().getNameWithAt();
+              return ((RepositoryDirectoryValue.Key) input).argument().toString();
             } else {
               throw new UnsupportedOperationException();
             }
@@ -172,7 +172,7 @@
         if (repo instanceof RepositoryDirectoryValue.Key) {
           message
               .append(" - ")
-              .append(((RepositoryDirectoryValue.Key) repo).argument().getNameWithAt())
+              .append(((RepositoryDirectoryValue.Key) repo).argument())
               .append("\n");
         }
       }
@@ -180,7 +180,7 @@
       if (missingRepo instanceof RepositoryDirectoryValue.Key) {
         message
             .append("This could either mean you have to add the '")
-            .append(((RepositoryDirectoryValue.Key) missingRepo).argument().getNameWithAt())
+            .append(((RepositoryDirectoryValue.Key) missingRepo).argument())
             .append("' repository with a statement like `http_archive` in your WORKSPACE file")
             .append(" (note that transitive dependencies are not added automatically), or move")
             .append(" an existing definition earlier in your WORKSPACE file.");
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/BzlmodRepoCycleReporter.java b/src/main/java/com/google/devtools/build/lib/skyframe/BzlmodRepoCycleReporter.java
index 2224251..65a60bd 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/BzlmodRepoCycleReporter.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/BzlmodRepoCycleReporter.java
@@ -104,7 +104,7 @@
           rawInput -> {
             SkyKey input = (SkyKey) rawInput;
             if (input instanceof RepositoryDirectoryValue.Key) {
-              return ((RepositoryDirectoryValue.Key) input).argument().getNameWithAt();
+              return ((RepositoryDirectoryValue.Key) input).argument().toString();
             } else if (input.argument() instanceof ModuleExtensionId) {
               ModuleExtensionId id = (ModuleExtensionId) input.argument();
               return String.format(
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/LocalRepositoryLookupValue.java b/src/main/java/com/google/devtools/build/lib/skyframe/LocalRepositoryLookupValue.java
index 69c30a3..2137731 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/LocalRepositoryLookupValue.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/LocalRepositoryLookupValue.java
@@ -163,7 +163,7 @@
 
     @Override
     public String toString() {
-      return "SuccessfulLocalRepositoryLookupValue(" + repositoryName.getNameWithAt() + ")";
+      return "SuccessfulLocalRepositoryLookupValue(" + repositoryName + ")";
     }
 
     @Override
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/PackageLookupFunction.java b/src/main/java/com/google/devtools/build/lib/skyframe/PackageLookupFunction.java
index 87ec403..fa3d429 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/PackageLookupFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/PackageLookupFunction.java
@@ -100,7 +100,7 @@
     RepositoryName repoName = packageKey.getRepository();
     if (!repoName.isVisible()) {
       return new PackageLookupValue.NoRepositoryPackageLookupValue(
-          repoName.getNameWithAt(),
+          repoName,
           String.format(
               "No repository visible as '@%s' from %s",
               repoName.getName(), repoName.getOwnerRepoDisplayString()));
@@ -157,7 +157,7 @@
       return "BUILD file not found in directory '"
           + packageKey.getPackageFragment()
           + "' of external repository "
-          + packageKey.getRepository().getNameWithAt()
+          + packageKey.getRepository()
           + ". "
           + educationalMessage;
     }
@@ -390,7 +390,7 @@
     }
     if (!repositoryValue.repositoryExists()) {
       return new PackageLookupValue.NoRepositoryPackageLookupValue(
-          id.getRepository().getNameWithAt(), repositoryValue.getErrorMsg());
+          id.getRepository(), repositoryValue.getErrorMsg());
     }
 
     // Check .bazelignore file after fetching the external repository.
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/PackageLookupValue.java b/src/main/java/com/google/devtools/build/lib/skyframe/PackageLookupValue.java
index 84aa517..a773362 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/PackageLookupValue.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/PackageLookupValue.java
@@ -17,6 +17,7 @@
 import com.google.common.base.Preconditions;
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.cmdline.PackageIdentifier;
+import com.google.devtools.build.lib.cmdline.RepositoryName;
 import com.google.devtools.build.lib.packages.BuildFileName;
 import com.google.devtools.build.lib.rules.repository.RepositoryDirectoryValue;
 import com.google.devtools.build.lib.skyframe.serialization.VisibleForSerialization;
@@ -382,10 +383,10 @@
    * a non-existent repository.
    */
   public static class NoRepositoryPackageLookupValue extends UnsuccessfulPackageLookupValue {
-    private final String repositoryName;
+    private final RepositoryName repositoryName;
     private final String reason;
 
-    NoRepositoryPackageLookupValue(String repositoryName, String reason) {
+    NoRepositoryPackageLookupValue(RepositoryName repositoryName, String reason) {
       this.repositoryName = repositoryName;
       this.reason = reason;
     }
diff --git a/src/main/java/com/google/devtools/build/skydoc/rendering/LabelRenderer.java b/src/main/java/com/google/devtools/build/skydoc/rendering/LabelRenderer.java
index a2ee007..19a57e9 100644
--- a/src/main/java/com/google/devtools/build/skydoc/rendering/LabelRenderer.java
+++ b/src/main/java/com/google/devtools/build/skydoc/rendering/LabelRenderer.java
@@ -23,7 +23,7 @@
  * A wrapper around a Starlark value printer which prints the Starlark representation of a value
  * with any embedded {@link Label} values rendered in a form suitable for API documentation.
  *
- * <p>Labels are rendered via {@link label#getShorthandDisplayForm} with a provided repository
+ * <p>Labels are rendered via {@link Label#getShorthandDisplayForm} with a provided repository
  * mapping, further adding an optional explicit repo name to labels in the main repo, and allowing
  * the {@code Label} constructor to be either included or omitted (rendering label objects as string
  * values).
diff --git a/src/test/java/com/google/devtools/build/lib/analysis/DeprecationValidatorTest.java b/src/test/java/com/google/devtools/build/lib/analysis/DeprecationValidatorTest.java
index 28f32e1..f0dcf5e 100644
--- a/src/test/java/com/google/devtools/build/lib/analysis/DeprecationValidatorTest.java
+++ b/src/test/java/com/google/devtools/build/lib/analysis/DeprecationValidatorTest.java
@@ -94,7 +94,7 @@
     checkWarning(
         "a",
         "a",
-        "target '//a:a' depends on deprecated target '@r//a:b': deprecation warning printed",
+        "target '//a:a' depends on deprecated target '@@r//a:b': deprecation warning printed",
         "filegroup(name='a', srcs=['@r//a:b'])");
   }
 
@@ -112,7 +112,7 @@
     checkWarning(
         "javatests/a",
         "a",
-        "target '//javatests/a:a' depends on deprecated target '@r//java/a:b': "
+        "target '//javatests/a:a' depends on deprecated target '@@r//java/a:b': "
             + "deprecation warning printed",
         "filegroup(name='a', srcs=['@r//java/a:b'])");
   }
diff --git a/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionResolutionTest.java b/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionResolutionTest.java
index 42a814e..5ae281f 100644
--- a/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionResolutionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleExtensionResolutionTest.java
@@ -1292,7 +1292,7 @@
     assertThat(result.hasError()).isTrue();
     assertThat(result.getError().getException())
         .hasMessageThat()
-        .contains("No repository visible as '@foo' from repository '@_main~ext~ext'");
+        .contains("No repository visible as '@foo' from repository '@@_main~ext~ext'");
   }
 
   @Test
@@ -1525,11 +1525,11 @@
     assertContainsEvent(
         "ERROR <no location>: Circular definition of repositories generated by module extensions"
             + " and/or .bzl files:\n"
-            + ".-> @_main~my_ext~candy1\n"
+            + ".-> @@_main~my_ext~candy1\n"
             + "|   extension 'my_ext' defined in //:defs.bzl\n"
-            + "|   @_main~my_ext2~candy2\n"
+            + "|   @@_main~my_ext2~candy2\n"
             + "|   extension 'my_ext2' defined in //:defs.bzl\n"
-            + "`-- @_main~my_ext~candy1");
+            + "`-- @@_main~my_ext~candy1");
   }
 
   @Test
@@ -1571,13 +1571,13 @@
     assertContainsEvent(
         "ERROR <no location>: Circular definition of repositories generated by module extensions"
             + " and/or .bzl files:\n"
-            + ".-> @_main~my_ext~candy1\n"
+            + ".-> @@_main~my_ext~candy1\n"
             + "|   extension 'my_ext' defined in //:defs.bzl\n"
-            + "|   @_main~my_ext2~candy2\n"
+            + "|   @@_main~my_ext2~candy2\n"
             + "|   extension 'my_ext2' defined in //:defs2.bzl\n"
             + "|   //:defs2.bzl\n"
-            + "|   @_main~my_ext~candy1//:data.bzl\n"
-            + "`-- @_main~my_ext~candy1");
+            + "|   @@_main~my_ext~candy1//:data.bzl\n"
+            + "`-- @@_main~my_ext~candy1");
   }
 
   @Test
@@ -1610,11 +1610,11 @@
     assertContainsEvent(
         "ERROR <no location>: Circular definition of repositories generated by module extensions"
             + " and/or .bzl files:\n"
-            + ".-> @_main~my_ext~candy1\n"
+            + ".-> @@_main~my_ext~candy1\n"
             + "|   extension 'my_ext' defined in //:defs.bzl\n"
             + "|   //:defs.bzl\n"
-            + "|   @_main~my_ext~candy1//:data.bzl\n"
-            + "`-- @_main~my_ext~candy1");
+            + "|   @@_main~my_ext~candy1//:data.bzl\n"
+            + "`-- @@_main~my_ext~candy1");
   }
 
   @Test
@@ -1959,7 +1959,7 @@
     assertThat(result.getError().getException())
         .hasMessageThat()
         .isEqualTo(
-            "module extension \"ext\" from \"@ext~1.0//:defs.bzl\" does not generate repository "
+            "module extension \"ext\" from \"@@ext~1.0//:defs.bzl\" does not generate repository "
                 + "\"invalid_dep\", yet it is imported as \"invalid_dep\" in the usage at "
                 + "/ws/MODULE.bazel:3:20");
 
@@ -2041,7 +2041,7 @@
     assertThat(result.getError().getException())
         .hasMessageThat()
         .isEqualTo(
-            "module extension \"ext\" from \"@ext~1.0//:defs.bzl\" does not generate repository "
+            "module extension \"ext\" from \"@@ext~1.0//:defs.bzl\" does not generate repository "
                 + "\"invalid_dep\", yet it is imported as \"invalid_dep\" in the usage at "
                 + "/ws/MODULE.bazel:3:20");
 
diff --git a/src/test/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryIntegrationTest.java b/src/test/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryIntegrationTest.java
index e77b35d..4465d6d 100644
--- a/src/test/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryIntegrationTest.java
+++ b/src/test/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkRepositoryIntegrationTest.java
@@ -263,9 +263,9 @@
         "Cycle in the workspace file detected."
             + " This indicates that a repository is used prior to being defined.\n"
             + "The following chain of repository dependencies lead to the missing definition.\n"
-            + " - @foobar\n"
-            + " - @foo\n");
-    assertContainsEvent("Failed to load Starlark extension '@foo//:def.bzl'.");
+            + " - @@foobar\n"
+            + " - @@foo\n");
+    assertContainsEvent("Failed to load Starlark extension '@@foo//:def.bzl'.");
   }
 
   @Test
@@ -292,8 +292,8 @@
         "Cycle in the workspace file detected."
             + " This indicates that a repository is used prior to being defined.\n"
             + "The following chain of repository dependencies lead to the missing definition.\n"
-            + " - @foo");
-    assertContainsEvent("Failed to load Starlark extension '@foo//:def.bzl'.");
+            + " - @@foo");
+    assertContainsEvent("Failed to load Starlark extension '@@foo//:def.bzl'.");
   }
 
   @Test
@@ -316,7 +316,7 @@
         .hasMessageThat()
         .contains(
             "Failed to load Starlark extension "
-                + "'@git_repo//xyz:foo.bzl'.\n"
+                + "'@@git_repo//xyz:foo.bzl'.\n"
                 + "Cycle in the workspace file detected."
                 + " This indicates that a repository is used prior to being defined.\n");
   }
diff --git a/src/test/java/com/google/devtools/build/lib/bazel/rules/android/AndroidNdkRepositoryTest.java b/src/test/java/com/google/devtools/build/lib/bazel/rules/android/AndroidNdkRepositoryTest.java
index 831bbac..c37de55 100644
--- a/src/test/java/com/google/devtools/build/lib/bazel/rules/android/AndroidNdkRepositoryTest.java
+++ b/src/test/java/com/google/devtools/build/lib/bazel/rules/android/AndroidNdkRepositoryTest.java
@@ -241,10 +241,10 @@
     Rule rule = cpufeatures.getTargetForTesting().getAssociatedRule();
     assertThat(rule.isAttributeValueExplicitlySpecified("srcs")).isTrue();
     assertThat(rule.getAttr("srcs").toString())
-        .isEqualTo("[@androidndk//:ndk/sources/android/cpufeatures/cpu-features.c]");
+        .isEqualTo("[@@androidndk//:ndk/sources/android/cpufeatures/cpu-features.c]");
     assertThat(rule.isAttributeValueExplicitlySpecified("hdrs")).isTrue();
     assertThat(rule.getAttr("hdrs").toString())
-        .isEqualTo("[@androidndk//:ndk/sources/android/cpufeatures/cpu-features.h]");
+        .isEqualTo("[@@androidndk//:ndk/sources/android/cpufeatures/cpu-features.h]");
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/bazel/rules/sh/BUILD b/src/test/java/com/google/devtools/build/lib/bazel/rules/sh/BUILD
index fa2c1d9..77e09ed 100644
--- a/src/test/java/com/google/devtools/build/lib/bazel/rules/sh/BUILD
+++ b/src/test/java/com/google/devtools/build/lib/bazel/rules/sh/BUILD
@@ -21,6 +21,7 @@
     deps = [
         "//src/main/java/com/google/devtools/build/lib/analysis:analysis_cluster",
         "//src/main/java/com/google/devtools/build/lib/analysis:configured_target",
+        "//src/main/java/com/google/devtools/build/lib/cmdline",
         "//src/test/java/com/google/devtools/build/lib/analysis/util",
         "//third_party:guava",
         "//third_party:junit4",
diff --git a/src/test/java/com/google/devtools/build/lib/bazel/rules/sh/BazelShTestConfiguredTargetTest.java b/src/test/java/com/google/devtools/build/lib/bazel/rules/sh/BazelShTestConfiguredTargetTest.java
index 2c92d72..06c4acf 100644
--- a/src/test/java/com/google/devtools/build/lib/bazel/rules/sh/BazelShTestConfiguredTargetTest.java
+++ b/src/test/java/com/google/devtools/build/lib/bazel/rules/sh/BazelShTestConfiguredTargetTest.java
@@ -19,6 +19,7 @@
 import com.google.devtools.build.lib.analysis.ConfiguredTarget;
 import com.google.devtools.build.lib.analysis.test.TestRunnerAction;
 import com.google.devtools.build.lib.analysis.util.BuildViewTestCase;
+import com.google.devtools.build.lib.cmdline.Label;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -45,8 +46,8 @@
     useConfiguration("--collect_code_coverage");
     reporter.removeHandler(failFastHandler);
     ConfiguredTarget ct = getConfiguredTarget("//:test");
-    assertThat(getRuleContext(ct).getPrerequisite(":lcov_merger").getLabel().toString())
-        .isEqualTo("@bazel_tools//tools/test:lcov_merger");
+    assertThat(getRuleContext(ct).getPrerequisite(":lcov_merger").getLabel())
+        .isEqualTo(Label.parseCanonicalUnchecked("@bazel_tools//tools/test:lcov_merger"));
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/WorkspaceBlackBoxTest.java b/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/WorkspaceBlackBoxTest.java
index 0b1192e..5cc197a 100644
--- a/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/WorkspaceBlackBoxTest.java
+++ b/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/WorkspaceBlackBoxTest.java
@@ -202,7 +202,7 @@
             // and Bazel recognizes that there is a terminal, so progress events will be displayed
             .withFlags("--experimental_ui_debug_all_events", "--curses=yes");
 
-    final String progressMessage = "PROGRESS <no location>: Loading package: @ext//";
+    final String progressMessage = "PROGRESS <no location>: Loading package: @@ext//";
 
     ProcessResult result = bazel.query("@ext//:all");
     assertThat(result.outString()).contains(progressMessage);
@@ -261,6 +261,6 @@
     context().write("BUILD");
     ProcessResult result = context().bazel().shouldFail().build("//...");
     assertThat(result.errString())
-        .contains("Error in local_repository: invalid repository name '@@a'");
+        .contains("Error in local_repository: invalid repository name '@a'");
   }
 }
diff --git a/src/test/java/com/google/devtools/build/lib/cmdline/LabelTest.java b/src/test/java/com/google/devtools/build/lib/cmdline/LabelTest.java
index 0650132..bdfc93e 100644
--- a/src/test/java/com/google/devtools/build/lib/cmdline/LabelTest.java
+++ b/src/test/java/com/google/devtools/build/lib/cmdline/LabelTest.java
@@ -189,27 +189,7 @@
     }
     {
       Label l = Label.parseCanonical("@foo");
-      assertThat(l.toString()).isEqualTo("@foo//:foo");
-    }
-  }
-
-  @Test
-  public void testToShorthandString() throws Exception {
-    {
-      Label l = Label.parseCanonical("//bar/baz:baz");
-      assertThat(l.toShorthandString()).isEqualTo("//bar/baz");
-    }
-    {
-      Label l = Label.parseCanonical("//bar/baz:bat");
-      assertThat(l.toShorthandString()).isEqualTo("//bar/baz:bat");
-    }
-    {
-      Label l = Label.parseCanonical("@foo//bar/baz:baz");
-      assertThat(l.toShorthandString()).isEqualTo("@foo//bar/baz");
-    }
-    {
-      Label l = Label.parseCanonical("@foo//bar/baz:bat");
-      assertThat(l.toShorthandString()).isEqualTo("@foo//bar/baz:bat");
+      assertThat(l.toString()).isEqualTo("@@foo//:foo");
     }
   }
 
@@ -322,7 +302,7 @@
   @Test
   public void testRepoLabel() throws Exception {
     Label label = Label.parseCanonical("@foo//bar/baz:bat/boo");
-    assertThat(label.toString()).isEqualTo("@foo//bar/baz:bat/boo");
+    assertThat(label.toString()).isEqualTo("@@foo//bar/baz:bat/boo");
   }
 
   @Test
@@ -349,7 +329,7 @@
         assertThrows(LabelSyntaxException.class, () -> Label.parseCanonical("@foo:xyz"));
     assertThat(e)
         .hasMessageThat()
-        .containsMatch("invalid repository name '@foo:xyz': repo names may contain only");
+        .containsMatch("invalid repository name 'foo:xyz': repo names may contain only");
   }
 
   @Test
@@ -393,7 +373,7 @@
                         PathFragment.create("baz")),
                     "quux")
                 .getUnambiguousCanonicalForm())
-        .isEqualTo("@@[unknown repo 'foo' requested from @bar]//baz:quux");
+        .isEqualTo("@@[unknown repo 'foo' requested from @@bar]//baz:quux");
   }
 
   private static String displayFormFor(String rawLabel, RepositoryMapping repositoryMapping)
@@ -428,7 +408,7 @@
             Label.parseWithRepoContext(
                     "@bad//abc", RepoContext.of(RepositoryName.MAIN, repositoryMapping))
                 .getDisplayForm(repositoryMapping))
-        .isEqualTo("@@[unknown repo 'bad' requested from @]//abc:abc");
+        .isEqualTo("@@[unknown repo 'bad' requested from @@]//abc:abc");
 
     assertThat(displayFormFor("@unremapped//:unremapped", RepositoryMapping.ALWAYS_FALLBACK))
         .isEqualTo("@unremapped//:unremapped");
@@ -472,7 +452,7 @@
             Label.parseWithRepoContext(
                     "@bad//abc", RepoContext.of(RepositoryName.MAIN, repositoryMapping))
                 .getShorthandDisplayForm(repositoryMapping))
-        .isEqualTo("@@[unknown repo 'bad' requested from @]//abc");
+        .isEqualTo("@@[unknown repo 'bad' requested from @@]//abc");
 
     assertThat(
             shorthandDisplayFormFor("@unremapped//:unremapped", RepositoryMapping.ALWAYS_FALLBACK))
@@ -489,7 +469,7 @@
 
     label = Label.parseCanonical("@hello//x");
     assertThat(Starlark.str(label, StarlarkSemantics.DEFAULT)).isEqualTo("@@hello//x:x");
-    assertThat(Starlark.repr(label)).isEqualTo("Label(\"@hello//x:x\")");
+    assertThat(Starlark.repr(label)).isEqualTo("Label(\"@@hello//x:x\")");
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/cmdline/PackageIdentifierTest.java b/src/test/java/com/google/devtools/build/lib/cmdline/PackageIdentifierTest.java
index 08e06d9..07f025f 100644
--- a/src/test/java/com/google/devtools/build/lib/cmdline/PackageIdentifierTest.java
+++ b/src/test/java/com/google/devtools/build/lib/cmdline/PackageIdentifierTest.java
@@ -57,7 +57,7 @@
     PackageIdentifier local = PackageIdentifier.create("", PathFragment.create("bar/baz"));
     assertThat(local.toString()).isEqualTo("bar/baz");
     PackageIdentifier external = PackageIdentifier.create("foo", PathFragment.create("bar/baz"));
-    assertThat(external.toString()).isEqualTo("@foo//bar/baz");
+    assertThat(external.toString()).isEqualTo("@@foo//bar/baz");
   }
 
   @Test
@@ -106,7 +106,7 @@
                     RepositoryName.create("foo").toNonVisible(RepositoryName.create("bar")),
                     PathFragment.create("baz"))
                 .getUnambiguousCanonicalForm())
-        .isEqualTo("@@[unknown repo 'foo' requested from @bar]//baz");
+        .isEqualTo("@@[unknown repo 'foo' requested from @@bar]//baz");
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/cmdline/RepositoryNameTest.java b/src/test/java/com/google/devtools/build/lib/cmdline/RepositoryNameTest.java
index c9d4528..482f2d2 100644
--- a/src/test/java/com/google/devtools/build/lib/cmdline/RepositoryNameTest.java
+++ b/src/test/java/com/google/devtools/build/lib/cmdline/RepositoryNameTest.java
@@ -36,19 +36,19 @@
 
   @Test
   public void testValidateRepositoryName() throws Exception {
-    assertThat(RepositoryName.create("foo").getNameWithAt()).isEqualTo("@foo");
-    assertThat(RepositoryName.create("").getNameWithAt()).isEqualTo("@");
+    assertThat(RepositoryName.create("foo").getName()).isEqualTo("foo");
+    assertThat(RepositoryName.create("").getName()).isEqualTo("");
     assertThat(RepositoryName.create("")).isSameInstanceAs(RepositoryName.MAIN);
-    assertThat(RepositoryName.create("foo_bar").getNameWithAt()).isEqualTo("@foo_bar");
-    assertThat(RepositoryName.create("foo-bar").getNameWithAt()).isEqualTo("@foo-bar");
-    assertThat(RepositoryName.create("foo.bar").getNameWithAt()).isEqualTo("@foo.bar");
-    assertThat(RepositoryName.create("..foo").getNameWithAt()).isEqualTo("@..foo");
-    assertThat(RepositoryName.create("foo..").getNameWithAt()).isEqualTo("@foo..");
-    assertThat(RepositoryName.create(".foo").getNameWithAt()).isEqualTo("@.foo");
-    assertThat(RepositoryName.create("foo~bar").getNameWithAt()).isEqualTo("@foo~bar");
+    assertThat(RepositoryName.create("foo_bar").getName()).isEqualTo("foo_bar");
+    assertThat(RepositoryName.create("foo-bar").getName()).isEqualTo("foo-bar");
+    assertThat(RepositoryName.create("foo.bar").getName()).isEqualTo("foo.bar");
+    assertThat(RepositoryName.create("..foo").getName()).isEqualTo("..foo");
+    assertThat(RepositoryName.create("foo..").getName()).isEqualTo("foo..");
+    assertThat(RepositoryName.create(".foo").getName()).isEqualTo(".foo");
+    assertThat(RepositoryName.create("foo~bar").getName()).isEqualTo("foo~bar");
 
-    assertNotValid(".", "repo names are not allowed to be '@.'");
-    assertNotValid("..", "repo names are not allowed to be '@..'");
+    assertNotValid(".", "repo names are not allowed to be '.'");
+    assertNotValid("..", "repo names are not allowed to be '..'");
     assertNotValid("foo/bar", "repo names may contain only A-Z, a-z, 0-9, '-', '_', '.' and '~'");
     assertNotValid("foo@", "repo names may contain only A-Z, a-z, 0-9, '-', '_', '.' and '~'");
     assertNotValid("foo\0", "repo names may contain only A-Z, a-z, 0-9, '-', '_', '.' and '~'");
@@ -79,7 +79,7 @@
   @Test
   public void testGetDefaultCanonicalForm() throws Exception {
     assertThat(RepositoryName.create("").getCanonicalForm()).isEqualTo("");
-    assertThat(RepositoryName.create("foo").getCanonicalForm()).isEqualTo("@foo");
+    assertThat(RepositoryName.create("foo").getCanonicalForm()).isEqualTo("@@foo");
   }
 
   @Test
@@ -98,11 +98,11 @@
             RepositoryName.create("")
                 .toNonVisible(RepositoryName.create("owner"))
                 .getDisplayForm(repositoryMapping))
-        .isEqualTo("@@[unknown repo '' requested from @owner]");
+        .isEqualTo("@@[unknown repo '' requested from @@owner]");
     assertThat(
             RepositoryName.create("local")
                 .toNonVisible(RepositoryName.create("owner"))
                 .getDisplayForm(repositoryMapping))
-        .isEqualTo("@@[unknown repo 'local' requested from @owner]");
+        .isEqualTo("@@[unknown repo 'local' requested from @@owner]");
   }
 }
diff --git a/src/test/java/com/google/devtools/build/lib/packages/PackageGroupTest.java b/src/test/java/com/google/devtools/build/lib/packages/PackageGroupTest.java
index 6250f7e..e5aced4 100644
--- a/src/test/java/com/google/devtools/build/lib/packages/PackageGroupTest.java
+++ b/src/test/java/com/google/devtools/build/lib/packages/PackageGroupTest.java
@@ -436,10 +436,10 @@
         .containsExactly(
             "a",
             "",
-            "@other//z",
+            "@@other//z",
             "a/b/...",
             "//...",
-            "@other//...",
+            "@@other//...",
             "-c",
             "-",
             "-c/d/...",
@@ -456,8 +456,8 @@
             "-//...",
             "//",
             "-//",
-            "@other//z",
-            "@other//...",
+            "@@other//z",
+            "@@other//...",
             "public",
             "private");
     assertThat(contents.packageStringsWithDoubleSlashAndWithoutRepository())
diff --git a/src/test/java/com/google/devtools/build/lib/query2/testutil/AbstractQueryTest.java b/src/test/java/com/google/devtools/build/lib/query2/testutil/AbstractQueryTest.java
index 0b75426..5256328 100644
--- a/src/test/java/com/google/devtools/build/lib/query2/testutil/AbstractQueryTest.java
+++ b/src/test/java/com/google/devtools/build/lib/query2/testutil/AbstractQueryTest.java
@@ -2329,12 +2329,12 @@
     helper.setMainRepoTargetParser(mapping);
   }
 
-  protected static final String REPO_A_RULES = "@repo~1.0//a:a_shar";
-  protected static final String REPO_AB_RULES = "@repo~1.0//a/b:a_b_shar";
+  protected static final String REPO_A_RULES = "@@repo~1.0//a:a_shar";
+  protected static final String REPO_AB_RULES = "@@repo~1.0//a/b:a_b_shar";
   protected static final String REPO_AB_ALL =
-      "@repo~1.0//a/b:BUILD @repo~1.0//a/b:a_b_shar @repo~1.0//a/b:p @repo~1.0//a/b:q";
+      "@@repo~1.0//a/b:BUILD @@repo~1.0//a/b:a_b_shar @@repo~1.0//a/b:p @@repo~1.0//a/b:q";
   protected static final String REPO_A_ALL =
-      "@repo~1.0//a:BUILD @repo~1.0//a:a_shar @repo~1.0//a:x @repo~1.0//a:y @repo~1.0//a:z";
+      "@@repo~1.0//a:BUILD @@repo~1.0//a:a_shar @@repo~1.0//a:x @@repo~1.0//a:y @@repo~1.0//a:z";
   protected static final String REPO_A_AB_RULES = REPO_AB_RULES + " " + REPO_A_RULES;
   protected static final String REPO_A_AB_ALL = REPO_AB_ALL + " " + REPO_A_ALL;
 
diff --git a/src/test/java/com/google/devtools/build/lib/query2/testutil/PostAnalysisQueryTest.java b/src/test/java/com/google/devtools/build/lib/query2/testutil/PostAnalysisQueryTest.java
index c3716f1..e681cbb 100644
--- a/src/test/java/com/google/devtools/build/lib/query2/testutil/PostAnalysisQueryTest.java
+++ b/src/test/java/com/google/devtools/build/lib/query2/testutil/PostAnalysisQueryTest.java
@@ -259,7 +259,7 @@
 
     // Check for implicit toolchain dependencies
     assertThat(evalToListOfStrings("deps(//test:my_rule)"))
-        .containsAtLeast(explicits, implicits, PLATFORM_LABEL);
+        .containsAtLeast(explicits, implicits, evalToString(PLATFORM_LABEL));
 
     helper.setQuerySettings(Setting.NO_IMPLICIT_DEPS);
     ImmutableList<String> filteredDeps = evalToListOfStrings("deps(//test:my_rule)");
@@ -370,7 +370,7 @@
 
     // Check for implicit toolchain dependencies
     assertThat(evalToListOfStrings("deps(//test:my_rule)"))
-        .containsAtLeast(explicits, implicits, PLATFORM_LABEL);
+        .containsAtLeast(explicits, implicits, evalToString(PLATFORM_LABEL));
 
     helper.setQuerySettings(Setting.NO_IMPLICIT_DEPS);
     ImmutableList<String> filteredDeps = evalToListOfStrings("deps(//test:my_rule)");
diff --git a/src/test/java/com/google/devtools/build/lib/rules/LabelBuildSettingTest.java b/src/test/java/com/google/devtools/build/lib/rules/LabelBuildSettingTest.java
index 6a40e28..5500ab2 100644
--- a/src/test/java/com/google/devtools/build/lib/rules/LabelBuildSettingTest.java
+++ b/src/test/java/com/google/devtools/build/lib/rules/LabelBuildSettingTest.java
@@ -344,7 +344,7 @@
     getConfiguredTarget("//test:arizona");
 
     assertContainsEvent(
-        "Error in transition: invalid transition input '@[unknown repo 'foobar' requested from @]"
+        "Error in transition: invalid transition input '@@[unknown repo 'foobar' requested from @@]"
             + "//test:formation': no repo visible as @foobar from main repository");
   }
 }
diff --git a/src/test/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorTest.java b/src/test/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorTest.java
index 95166b3..2fd6bfc 100644
--- a/src/test/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorTest.java
+++ b/src/test/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorTest.java
@@ -412,7 +412,8 @@
     assertThat(result.hasError()).isFalse();
     RepositoryDirectoryValue repositoryDirectoryValue = (RepositoryDirectoryValue) result.get(key);
     assertThat(repositoryDirectoryValue.repositoryExists()).isFalse();
-    assertThat(repositoryDirectoryValue.getErrorMsg()).contains("Repository '@foo' is not defined");
+    assertThat(repositoryDirectoryValue.getErrorMsg())
+        .contains("Repository '@@foo' is not defined");
   }
 
   @Test
@@ -482,7 +483,7 @@
     RepositoryDirectoryValue repositoryDirectoryValue = (RepositoryDirectoryValue) result.get(key);
     assertThat(repositoryDirectoryValue.repositoryExists()).isFalse();
     assertThat(repositoryDirectoryValue.getErrorMsg())
-        .contains("No repository visible as '@foo' from repository '@fake_owner_repo'");
+        .contains("No repository visible as '@foo' from repository '@@fake_owner_repo'");
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/skyframe/BuiltinsInjectionTest.java b/src/test/java/com/google/devtools/build/lib/skyframe/BuiltinsInjectionTest.java
index 1da9673..0e60c85 100644
--- a/src/test/java/com/google/devtools/build/lib/skyframe/BuiltinsInjectionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skyframe/BuiltinsInjectionTest.java
@@ -41,7 +41,6 @@
 import com.google.devtools.build.lib.events.EventHandler;
 import com.google.devtools.build.lib.packages.Attribute;
 import com.google.devtools.build.lib.packages.BuildType;
-import com.google.devtools.build.lib.packages.RuleClass.ConfiguredTargetFactory.RuleErrorException;
 import com.google.devtools.build.lib.packages.Type;
 import com.google.devtools.build.lib.packages.semantics.BuildLanguageOptions;
 import com.google.devtools.build.lib.testutil.TestRuleClassProvider;
@@ -382,7 +381,7 @@
     writePkgBzl("load('@@_builtins//:exports.bzl', 'exported_toplevels')");
 
     buildAndAssertFailure();
-    assertContainsEvent("The repository '@_builtins' could not be resolved");
+    assertContainsEvent("The repository '@@_builtins' could not be resolved");
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/skyframe/BzlLoadFunctionTest.java b/src/test/java/com/google/devtools/build/lib/skyframe/BzlLoadFunctionTest.java
index 1626ebf..6160a78 100644
--- a/src/test/java/com/google/devtools/build/lib/skyframe/BzlLoadFunctionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skyframe/BzlLoadFunctionTest.java
@@ -342,8 +342,8 @@
     SkyKey skyKey = key(label);
     EvaluationResult<BzlLoadValue> result = get(skyKey);
     // Ensure that the file has been processed by checking its Module for the label field.
-    assertThat(label)
-        .isEqualTo(BazelModuleContext.of(result.get(skyKey).getModule()).label().toString());
+    assertThat(Label.parseCanonicalUnchecked(label))
+        .isEqualTo(BazelModuleContext.of(result.get(skyKey).getModule()).label());
   }
 
   /* Loads a .bzl with the given label and asserts BzlLoadFailedException with the given message. */
@@ -806,7 +806,7 @@
     checkFailingLookup(
         "//pkg:foo2.bzl", "module //pkg:foo2.bzl contains .bzl load visibility violations");
     assertContainsEvent(
-        "Starlark file @repo//lib:bar.bzl is not visible for loading from package //pkg.");
+        "Starlark file @@repo//lib:bar.bzl is not visible for loading from package //pkg.");
   }
 
   // TODO(#16365): This test case can be deleted once --incompatible_package_group_has_public_syntax
@@ -861,9 +861,9 @@
 
     reporter.removeHandler(failFastHandler);
     checkFailingLookup(
-        "@repo//a:foo.bzl", "module @repo//a:foo.bzl contains .bzl load visibility violations");
+        "@repo//a:foo.bzl", "module @@repo//a:foo.bzl contains .bzl load visibility violations");
     assertContainsEvent(
-        "Starlark file //b:bar.bzl is not visible for loading from package @repo//a.");
+        "Starlark file //b:bar.bzl is not visible for loading from package @@repo//a.");
   }
 
   @Test
@@ -1013,8 +1013,8 @@
         .hasExceptionThat()
         .hasMessageThat()
         .contains(
-            "Unable to find package for @repository//dir:file.bzl: The repository '@repository' "
-                + "could not be resolved: Repository '@repository' is not defined.");
+            "Unable to find package for @@repository//dir:file.bzl: The repository '@@repository' "
+                + "could not be resolved: Repository '@@repository' is not defined.");
   }
 
   @Test
diff --git a/src/test/java/com/google/devtools/build/lib/skyframe/ContainingPackageLookupFunctionTest.java b/src/test/java/com/google/devtools/build/lib/skyframe/ContainingPackageLookupFunctionTest.java
index 01038df..59a26a6 100644
--- a/src/test/java/com/google/devtools/build/lib/skyframe/ContainingPackageLookupFunctionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skyframe/ContainingPackageLookupFunctionTest.java
@@ -317,7 +317,7 @@
     assertThat(value.getClass()).isEqualTo(NoContainingPackage.class);
     assertThat(value.getReasonForNoContainingPackage())
         .isEqualTo(
-            "The repository '@some_repo' could not be resolved: Repository '@some_repo' is not"
+            "The repository '@@some_repo' could not be resolved: Repository '@@some_repo' is not"
                 + " defined");
   }
 
diff --git a/src/test/java/com/google/devtools/build/lib/skyframe/LocalRepositoryLookupFunctionTest.java b/src/test/java/com/google/devtools/build/lib/skyframe/LocalRepositoryLookupFunctionTest.java
index 33aefce..244ba88 100644
--- a/src/test/java/com/google/devtools/build/lib/skyframe/LocalRepositoryLookupFunctionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skyframe/LocalRepositoryLookupFunctionTest.java
@@ -205,7 +205,7 @@
             RootedPath.toRootedPath(
                 Root.fromPath(rootDirectory), PathFragment.create("local/repo")));
     assertThat(repositoryLookupValue).isNotNull();
-    assertThat(repositoryLookupValue.getRepository().getNameWithAt()).isEqualTo("@local");
+    assertThat(repositoryLookupValue.getRepository().getName()).isEqualTo("local");
     assertThat(repositoryLookupValue.getPath()).isEqualTo(PathFragment.create("local/repo"));
   }
 
@@ -221,7 +221,7 @@
                 Root.fromPath(rootDirectory.getRelative("/abs")),
                 PathFragment.create("local/repo")));
     assertThat(repositoryLookupValue).isNotNull();
-    assertThat(repositoryLookupValue.getRepository().getNameWithAt()).isEqualTo("@local");
+    assertThat(repositoryLookupValue.getRepository().getName()).isEqualTo("local");
     assertThat(repositoryLookupValue.getPath()).isEqualTo(PathFragment.create("/abs/local/repo"));
   }
 
@@ -236,7 +236,7 @@
             RootedPath.toRootedPath(
                 Root.fromPath(rootDirectory), PathFragment.create("local/repo")));
     assertThat(repositoryLookupValue).isNotNull();
-    assertThat(repositoryLookupValue.getRepository().getNameWithAt()).isEqualTo("@local");
+    assertThat(repositoryLookupValue.getRepository().getName()).isEqualTo("local");
     assertThat(repositoryLookupValue.getPath()).isEqualTo(PathFragment.create("local/repo"));
   }
 
@@ -252,7 +252,7 @@
                 Root.fromPath(rootDirectory.getRelative("/abs")),
                 PathFragment.create("local/repo")));
     assertThat(repositoryLookupValue).isNotNull();
-    assertThat(repositoryLookupValue.getRepository().getNameWithAt()).isEqualTo("@local");
+    assertThat(repositoryLookupValue.getRepository().getName()).isEqualTo("local");
     assertThat(repositoryLookupValue.getPath()).isEqualTo(PathFragment.create("/abs/local/repo"));
   }
 
@@ -268,7 +268,7 @@
             RootedPath.toRootedPath(
                 Root.fromPath(rootDirectory), PathFragment.create("local/repo/sub/package")));
     assertThat(repositoryLookupValue).isNotNull();
-    assertThat(repositoryLookupValue.getRepository().getNameWithAt()).isEqualTo("@local");
+    assertThat(repositoryLookupValue.getRepository().getName()).isEqualTo("local");
     assertThat(repositoryLookupValue.getPath()).isEqualTo(PathFragment.create("local/repo"));
   }
 
diff --git a/src/test/java/com/google/devtools/build/lib/skyframe/PackageLookupFunctionTest.java b/src/test/java/com/google/devtools/build/lib/skyframe/PackageLookupFunctionTest.java
index 7c625e2..3f08949 100644
--- a/src/test/java/com/google/devtools/build/lib/skyframe/PackageLookupFunctionTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skyframe/PackageLookupFunctionTest.java
@@ -517,14 +517,14 @@
     public static List<Object[]> parameters() {
       List<Object[]> params = new ArrayList<>();
 
-      params.add(new String[] {"simpleRepo_emptyPackage", "local", "", "@local//"});
-      params.add(new String[] {"simpleRepo_singlePackage", "local", "package", "@local//package"});
+      params.add(new String[] {"simpleRepo_emptyPackage", "local", "", "@@local//"});
+      params.add(new String[] {"simpleRepo_singlePackage", "local", "package", "@@local//package"});
       params.add(
           new String[] {
-            "simpleRepo_subPackage", "local", "package/subpackage", "@local//package/subpackage"
+            "simpleRepo_subPackage", "local", "package/subpackage", "@@local//package/subpackage"
           });
-      params.add(new String[] {"deepRepo_emptyPackage", "local/repo", "", "@local//"});
-      params.add(new String[] {"deepRepo_subPackage", "local/repo", "package", "@local//package"});
+      params.add(new String[] {"deepRepo_emptyPackage", "local/repo", "", "@@local//"});
+      params.add(new String[] {"deepRepo_subPackage", "local/repo", "package", "@@local//package"});
 
       return params;
     }
diff --git a/src/test/java/com/google/devtools/build/lib/starlark/StarlarkDefinedAspectsTest.java b/src/test/java/com/google/devtools/build/lib/starlark/StarlarkDefinedAspectsTest.java
index 4fe5853..24182ff 100644
--- a/src/test/java/com/google/devtools/build/lib/starlark/StarlarkDefinedAspectsTest.java
+++ b/src/test/java/com/google/devtools/build/lib/starlark/StarlarkDefinedAspectsTest.java
@@ -218,7 +218,7 @@
         update(ImmutableList.of("@local//:aspect.bzl%MyAspect"), "//test:xxx");
     assertThat(getLabelsToBuild(analysisResult)).containsExactly("//test:xxx");
     assertThat(getAspectDescriptions(analysisResult))
-        .containsExactly("@local//:aspect.bzl%MyAspect(//test:xxx)");
+        .containsExactly("@@local//:aspect.bzl%MyAspect(//test:xxx)");
   }
 
   private static Iterable<String> getLabelsToBuild(AnalysisResult analysisResult) {
diff --git a/src/test/java/com/google/devtools/build/lib/starlark/StarlarkOptionsParsingTest.java b/src/test/java/com/google/devtools/build/lib/starlark/StarlarkOptionsParsingTest.java
index 7610780..ff047f5 100644
--- a/src/test/java/com/google/devtools/build/lib/starlark/StarlarkOptionsParsingTest.java
+++ b/src/test/java/com/google/devtools/build/lib/starlark/StarlarkOptionsParsingTest.java
@@ -110,7 +110,7 @@
     assertThat(result.getStarlarkOptions()).hasSize(2);
     assertThat(result.getStarlarkOptions().get("//test:my_int_setting"))
         .isEqualTo(StarlarkInt.of(666));
-    assertThat(result.getStarlarkOptions().get("@repo2//:flag2")).isEqualTo(StarlarkInt.of(222));
+    assertThat(result.getStarlarkOptions().get("@@repo2//:flag2")).isEqualTo(StarlarkInt.of(222));
     assertThat(result.getResidue()).isEmpty();
   }
 
diff --git a/src/test/java/com/google/devtools/build/lib/starlark/StarlarkRuleClassFunctionsTest.java b/src/test/java/com/google/devtools/build/lib/starlark/StarlarkRuleClassFunctionsTest.java
index 0364f42..840ac60 100644
--- a/src/test/java/com/google/devtools/build/lib/starlark/StarlarkRuleClassFunctionsTest.java
+++ b/src/test/java/com/google/devtools/build/lib/starlark/StarlarkRuleClassFunctionsTest.java
@@ -4187,10 +4187,9 @@
     Rule rule = getRuleContext(myTarget).getRule();
 
     assertNoEvents();
-    assertThat(
-            rule.getRuleClassObject().getExecutionPlatformConstraints().stream()
-                .map(Label::toString))
-        .containsExactly(constr1, constr2);
+    assertThat(rule.getRuleClassObject().getExecutionPlatformConstraints())
+        .containsExactly(
+            Label.parseCanonicalUnchecked(constr1), Label.parseCanonicalUnchecked(constr2));
   }
 
   @Test
@@ -4500,14 +4499,14 @@
                 EvalException.class, () -> eval(module, "Label('@//foo:bar').workspace_name")))
         .hasMessageThat()
         .isEqualTo(
-            "'workspace_name' is not allowed on invalid Label @[unknown repo '' requested from"
-                + " @module~1.2.3]//foo:bar");
+            "'workspace_name' is not allowed on invalid Label @@[unknown repo '' requested from"
+                + " @@module~1.2.3]//foo:bar");
     assertThat(
             assertThrows(
                 EvalException.class, () -> eval(module, "Label('@//foo:bar').workspace_root")))
         .hasMessageThat()
         .isEqualTo(
-            "'workspace_root' is not allowed on invalid Label @[unknown repo '' requested from"
-                + " @module~1.2.3]//foo:bar");
+            "'workspace_root' is not allowed on invalid Label @@[unknown repo '' requested from"
+                + " @@module~1.2.3]//foo:bar");
   }
 }
diff --git a/src/test/java/com/google/devtools/build/lib/starlark/StarlarkRuleContextTest.java b/src/test/java/com/google/devtools/build/lib/starlark/StarlarkRuleContextTest.java
index 16de5de..fcbfa33 100644
--- a/src/test/java/com/google/devtools/build/lib/starlark/StarlarkRuleContextTest.java
+++ b/src/test/java/com/google/devtools/build/lib/starlark/StarlarkRuleContextTest.java
@@ -392,7 +392,7 @@
     getConfiguredTarget("//:cclib");
     assertContainsEvent(
         "/workspace/BUILD:1:11: Label '//:r/my_sub_lib.h' is invalid because "
-            + "'@r//' is a subpackage");
+            + "'@@r//' is a subpackage");
   }
 
   /* The error message for this case used to be wrong. */
@@ -412,9 +412,9 @@
     reporter.removeHandler(failFastHandler);
     getConfiguredTarget("@r//:cclib");
     assertContainsEvent(
-        "/external/r/BUILD:1:11: Label '@r//:sub/my_sub_lib.h' is invalid because "
-            + "'@r//sub' is a subpackage; perhaps you meant to put the colon here: "
-            + "'@r//sub:my_sub_lib.h'?");
+        "/external/r/BUILD:1:11: Label '@@r//:sub/my_sub_lib.h' is invalid because "
+            + "'@@r//sub' is a subpackage; perhaps you meant to put the colon here: "
+            + "'@@r//sub:my_sub_lib.h'?");
   }
 
   /*
diff --git a/src/test/java/com/google/devtools/build/lib/testutil/TestConstants.java b/src/test/java/com/google/devtools/build/lib/testutil/TestConstants.java
index 118086d..2019515 100644
--- a/src/test/java/com/google/devtools/build/lib/testutil/TestConstants.java
+++ b/src/test/java/com/google/devtools/build/lib/testutil/TestConstants.java
@@ -176,10 +176,10 @@
       "@bazel_tools//tools/jdk:proguard_whitelister";
 
   /** The java toolchain type. */
-  public static final String JAVA_TOOLCHAIN_TYPE = "@bazel_tools//tools/jdk:toolchain_type";
+  public static final String JAVA_TOOLCHAIN_TYPE = "@@bazel_tools//tools/jdk:toolchain_type";
 
   /** The cpp toolchain type. */
-  public static final String CPP_TOOLCHAIN_TYPE = "@bazel_tools//tools/cpp:toolchain_type";
+  public static final String CPP_TOOLCHAIN_TYPE = "@@bazel_tools//tools/cpp:toolchain_type";
 
   /** A choice of test execution mode, only varies internally. */
   public enum InternalTestExecutionMode {
diff --git a/src/test/java/com/google/devtools/build/skydoc/rendering/LabelRendererTest.java b/src/test/java/com/google/devtools/build/skydoc/rendering/LabelRendererTest.java
index 2d438fc..dc536d6 100644
--- a/src/test/java/com/google/devtools/build/skydoc/rendering/LabelRendererTest.java
+++ b/src/test/java/com/google/devtools/build/skydoc/rendering/LabelRendererTest.java
@@ -23,7 +23,6 @@
 import com.google.devtools.build.lib.cmdline.RepositoryName;
 import java.util.Optional;
 import net.starlark.java.eval.Dict;
-import net.starlark.java.eval.Starlark;
 import net.starlark.java.eval.StarlarkList;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -38,33 +37,15 @@
     Label mainRepoLabel = Label.parseCanonicalUnchecked("//foo:bar");
     Label depRepoLabel = Label.parseCanonicalUnchecked("@dep//foo:baz");
 
-    assertThat(LabelRenderer.DEFAULT.render(mainRepoLabel))
-        .isEqualTo(mainRepoLabel.toShorthandString());
+    assertThat(LabelRenderer.DEFAULT.render(mainRepoLabel)).isEqualTo("//foo:bar");
     assertThat(LabelRenderer.DEFAULT.reprWithoutLabelConstructor(mainRepoLabel))
-        .isEqualTo(Starlark.repr(mainRepoLabel.toShorthandString()));
-    assertThat(LabelRenderer.DEFAULT.repr(mainRepoLabel)).isEqualTo(Starlark.repr(mainRepoLabel));
+        .isEqualTo("\"//foo:bar\"");
+    assertThat(LabelRenderer.DEFAULT.repr(mainRepoLabel)).isEqualTo("Label(\"//foo:bar\")");
 
-    assertThat(LabelRenderer.DEFAULT.render(mainRepoLabel))
-        .isEqualTo(mainRepoLabel.toShorthandString());
+    assertThat(LabelRenderer.DEFAULT.render(depRepoLabel)).isEqualTo("@dep//foo:baz");
     assertThat(LabelRenderer.DEFAULT.reprWithoutLabelConstructor(depRepoLabel))
-        .isEqualTo(Starlark.repr(depRepoLabel.toShorthandString()));
-    assertThat(LabelRenderer.DEFAULT.repr(depRepoLabel)).isEqualTo(Starlark.repr(depRepoLabel));
-  }
-
-  private static void verifyConsistency(
-      LabelRenderer labelRenderer, Label label, RepositoryMapping repositoryMapping) {
-    String rendering = labelRenderer.render(label);
-    Label parsedRenderedLabel = Label.parseCanonicalUnchecked(rendering);
-
-    assertThat(rendering)
-        .isEqualTo(
-            parsedRenderedLabel.getShorthandDisplayForm(
-                // If we are prepending an explicit main repo name, it will not be in the repository
-                // mapping, so we need to allow fallback when calling Label#getShorthandDisplayForm.
-                RepositoryMapping.createAllowingFallback(repositoryMapping.entries())));
-    assertThat(labelRenderer.reprWithoutLabelConstructor(label))
-        .isEqualTo(Starlark.repr(rendering));
-    assertThat(labelRenderer.repr(label)).isEqualTo(Starlark.repr(parsedRenderedLabel));
+        .isEqualTo("\"@dep//foo:baz\"");
+    assertThat(LabelRenderer.DEFAULT.repr(depRepoLabel)).isEqualTo("Label(\"@dep//foo:baz\")");
   }
 
   @Test
@@ -82,9 +63,6 @@
     assertThat(labelRenderer.reprWithoutLabelConstructor(dict))
         .isEqualTo("{\"//foo:bar\": \"//foo\"}");
     assertThat(labelRenderer.repr(dict)).isEqualTo("{Label(\"//foo:bar\"): Label(\"//foo:foo\")}");
-
-    verifyConsistency(labelRenderer, label, repositoryMapping);
-    verifyConsistency(labelRenderer, shorthandLabel, repositoryMapping);
   }
 
   @Test
@@ -108,10 +86,6 @@
         .isEqualTo(
             "[Label(\"@my_main//foo:bar\"), Label(\"@my_main//foo:foo\"),"
                 + " Label(\"@my_main//:my_main\")]");
-
-    verifyConsistency(labelRenderer, label, repositoryMapping);
-    verifyConsistency(labelRenderer, shorthandLabel, repositoryMapping);
-    verifyConsistency(labelRenderer, ultraShorthandLabel, repositoryMapping);
   }
 
   @Test
@@ -132,8 +106,5 @@
         .isEqualTo("[\"@local//foo:bar\", \"@local//foo\"]");
     assertThat(labelRenderer.repr(list))
         .isEqualTo("[Label(\"@local//foo:bar\"), Label(\"@local//foo:foo\")]");
-
-    verifyConsistency(labelRenderer, label, repositoryMapping);
-    verifyConsistency(labelRenderer, shorthandLabel, repositoryMapping);
   }
 }
diff --git a/src/test/java/com/google/devtools/build/skydoc/testdata/function_wrap_multiple_lines_test/golden.textproto b/src/test/java/com/google/devtools/build/skydoc/testdata/function_wrap_multiple_lines_test/golden.textproto
index e3255e3..04cc9c3 100644
--- a/src/test/java/com/google/devtools/build/skydoc/testdata/function_wrap_multiple_lines_test/golden.textproto
+++ b/src/test/java/com/google/devtools/build/skydoc/testdata/function_wrap_multiple_lines_test/golden.textproto
@@ -125,7 +125,7 @@
     name: "deps"
     doc_string: "The dependencies to use. Defaults to the most recent ANTLR 3 release,\nbut if you need to use a different version, you can specify the\ndependencies here."
     type: LABEL_LIST
-    default_value: "[Label(\"@antlr3_runtimes//:tool\")]"
+    default_value: "[Label(\"@@antlr3_runtimes//:tool\")]"
   }
   attribute {
     name: "dfa"
diff --git a/src/test/py/bazel/bazel_external_repository_test.py b/src/test/py/bazel/bazel_external_repository_test.py
index 08c5980..69ba318 100644
--- a/src/test/py/bazel/bazel_external_repository_test.py
+++ b/src/test/py/bazel/bazel_external_repository_test.py
@@ -290,8 +290,7 @@
         allow_failure=True,
     )
     self.AssertExitCode(exit_code, 1, stderr)
-    self.assertIn('\'@other_repo//pkg/ignore\' is a subpackage',
-                  ''.join(stderr))
+    self.assertIn("'@@other_repo//pkg/ignore' is a subpackage", ''.join(stderr))
 
     self.RunBazel(
         args=[
@@ -328,8 +327,7 @@
         allow_failure=True,
     )
     self.AssertExitCode(exit_code, 1, stderr)
-    self.assertIn('\'@other_repo//pkg/ignore\' is a subpackage',
-                  ''.join(stderr))
+    self.assertIn("'@@other_repo//pkg/ignore' is a subpackage", ''.join(stderr))
 
     self.ScratchFile('other_repo/.bazelignore', [
         'pkg/ignore',
@@ -347,8 +345,7 @@
         args=['build', '//:all_files'], cwd=work_dir, allow_failure=True
     )
     self.AssertExitCode(exit_code, 1, stderr)
-    self.assertIn('no such package \'@other_repo//pkg/ignore\'',
-                  ''.join(stderr))
+    self.assertIn("no such package '@@other_repo//pkg/ignore'", ''.join(stderr))
 
   def testUniverseScopeWithBazelIgnoreInExternalRepo(self):
     self.ScratchFile('other_repo/WORKSPACE')
diff --git a/src/test/py/bazel/bazel_workspace_test.py b/src/test/py/bazel/bazel_workspace_test.py
index afd2bcb..ccd487b 100644
--- a/src/test/py/bazel/bazel_workspace_test.py
+++ b/src/test/py/bazel/bazel_workspace_test.py
@@ -75,7 +75,7 @@
         args=["build", ":bin"], cwd=work_dir, allow_failure=True
     )
     self.AssertExitCode(exit_code, 1, stderr)
-    self.assertIn("no such package '@A//'", "".join(stderr))
+    self.assertIn("no such package '@@A//'", "".join(stderr))
 
     # Test a WORKSPACE.bazel directory won't confuse Bazel
     self.ScratchFile("B/WORKSPACE",
diff --git a/src/test/py/bazel/bzlmod/bazel_fetch_test.py b/src/test/py/bazel/bzlmod/bazel_fetch_test.py
index 783573d..d7867d6 100644
--- a/src/test/py/bazel/bzlmod/bazel_fetch_test.py
+++ b/src/test/py/bazel/bzlmod/bazel_fetch_test.py
@@ -218,7 +218,7 @@
     )
     self.AssertExitCode(exit_code, 8, stderr)
     self.assertIn(
-        "ERROR: Fetching repos failed with errors: Repository '@nono' is not "
+        "ERROR: Fetching repos failed with errors: Repository '@@nono' is not "
         "defined; No repository visible as '@nana' from main repository",
         stderr,
     )
diff --git a/src/test/py/bazel/bzlmod/bazel_overrides_test.py b/src/test/py/bazel/bzlmod/bazel_overrides_test.py
index 1912754..f998a04 100644
--- a/src/test/py/bazel/bzlmod/bazel_overrides_test.py
+++ b/src/test/py/bazel/bzlmod/bazel_overrides_test.py
@@ -272,7 +272,7 @@
     )
     # module file override should be ignored, and bb directory should be used
     self.assertIn(
-        'Target @ss~override//:choose_me up-to-date (nothing to build)', stderr
+        'Target @@ss~override//:choose_me up-to-date (nothing to build)', stderr
     )
 
   def testCmdRelativeModuleOverride(self):
@@ -312,7 +312,7 @@
         cwd=self.Path('aa/cc'),
     )
     self.assertIn(
-        'Target @ss~override//:choose_me up-to-date (nothing to build)', stderr
+        'Target @@ss~override//:choose_me up-to-date (nothing to build)', stderr
     )
 
   def testCmdWorkspaceRelativeModuleOverride(self):
@@ -349,7 +349,7 @@
         cwd=self.Path('aa'),
     )
     self.assertIn(
-        'Target @ss~override//:choose_me up-to-date (nothing to build)', stderr
+        'Target @@ss~override//:choose_me up-to-date (nothing to build)', stderr
     )
 
 
diff --git a/src/test/py/bazel/bzlmod/bzlmod_query_test.py b/src/test/py/bazel/bzlmod/bzlmod_query_test.py
index 5997fc8..4c6351b 100644
--- a/src/test/py/bazel/bzlmod/bzlmod_query_test.py
+++ b/src/test/py/bazel/bzlmod/bzlmod_query_test.py
@@ -307,7 +307,7 @@
     self.assertIsNotNone(output_file)
     output = output_file.readlines()
     output_file.close()
-    self.assertListEqual(['@aaa~1.0//:lib_aaa\n'], output)
+    self.assertListEqual(['@@aaa~1.0//:lib_aaa\n'], output)
 
   def testQueryCannotResolveRepoMapping_malformedModuleFile(self):
     self.ScratchFile('MODULE.bazel', [
diff --git a/src/test/shell/bazel/allowlist_test.sh b/src/test/shell/bazel/allowlist_test.sh
index d292fd8..3f94a41 100755
--- a/src/test/shell/bazel/allowlist_test.sh
+++ b/src/test/shell/bazel/allowlist_test.sh
@@ -143,7 +143,7 @@
 
   bazel build //vinegar \
     >& $TEST_log && fail "Expected failure"
-  expect_log "_allowlist_function_transition attribute (@bazel_tools//tools/allowlists/bad:bad)"
+  expect_log "_allowlist_function_transition attribute (@@bazel_tools//tools/allowlists/bad:bad)"
   expect_log "does not have the expected value //tools/allowlists/function_transition_allowlist:function_transition_allowlist"
 }
 
diff --git a/src/test/shell/bazel/bazel_java_test_defaults.sh b/src/test/shell/bazel/bazel_java_test_defaults.sh
index ce4b5b3..222bdc9 100755
--- a/src/test/shell/bazel/bazel_java_test_defaults.sh
+++ b/src/test/shell/bazel/bazel_java_test_defaults.sh
@@ -427,11 +427,11 @@
 
   bazel build --platforms=//pkg:exotic_platform --java_runtime_version=local_jdk \
     //pkg:foo &>"$TEST_log" && fail "Build should fail"
-  expect_log "While resolving toolchains for target //pkg:foo ([0-9a-f]*): No matching toolchains found for types @bazel_tools//tools/jdk:runtime_toolchain_type"
+  expect_log "While resolving toolchains for target //pkg:foo ([0-9a-f]*): No matching toolchains found for types @@bazel_tools//tools/jdk:runtime_toolchain_type"
 
   bazel build --platforms=//pkg:exotic_platform --java_runtime_version=local_jdk \
     //pkg:foo_deploy.jar &>"$TEST_log" && fail "Build should fail"
-  expect_log "While resolving toolchains for target //pkg:foo_deployjars_internal_rule ([0-9a-f]*): No matching toolchains found for types @bazel_tools//tools/jdk:runtime_toolchain_type"
+  expect_log "While resolving toolchains for target //pkg:foo_deployjars_internal_rule ([0-9a-f]*): No matching toolchains found for types @@bazel_tools//tools/jdk:runtime_toolchain_type"
 }
 
 function test_executable_java_binary_fails_without_runtime_with_remote_jdk() {
@@ -456,11 +456,11 @@
 
   bazel build --platforms=//pkg:exotic_platform --java_runtime_version=remotejdk_11 \
     //pkg:foo &>"$TEST_log" && fail "Build should fail"
-  expect_log "While resolving toolchains for target //pkg:foo ([0-9a-f]*): No matching toolchains found for types @bazel_tools//tools/jdk:runtime_toolchain_type"
+  expect_log "While resolving toolchains for target //pkg:foo ([0-9a-f]*): No matching toolchains found for types @@bazel_tools//tools/jdk:runtime_toolchain_type"
 
   bazel build --platforms=//pkg:exotic_platform --java_runtime_version=remotejdk_11 \
     //pkg:foo_deploy.jar &>"$TEST_log" && fail "Build should fail"
-  expect_log "While resolving toolchains for target //pkg:foo_deployjars_internal_rule ([0-9a-f]*): No matching toolchains found for types @bazel_tools//tools/jdk:runtime_toolchain_type"
+  expect_log "While resolving toolchains for target //pkg:foo_deployjars_internal_rule ([0-9a-f]*): No matching toolchains found for types @@bazel_tools//tools/jdk:runtime_toolchain_type"
 }
 
 run_suite "Java toolchains tests, configured using flags or the default_java_toolchain macro."
diff --git a/src/test/shell/bazel/bazel_with_jdk_test.sh b/src/test/shell/bazel/bazel_with_jdk_test.sh
index bbc4442..8ad81b7 100755
--- a/src/test/shell/bazel/bazel_with_jdk_test.sh
+++ b/src/test/shell/bazel/bazel_with_jdk_test.sh
@@ -173,19 +173,19 @@
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=8 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 8 and selecting it failed"
-  expect_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 
   bazel cquery \
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=local_jdk_8 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 8 and selecting it failed"
-  expect_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 
   bazel cquery \
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=11 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 8 and selecting it failed"
-  expect_not_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_not_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 }
 
 # Bazel shall detect JDK version and configure it with "local_jdk_{version}" and "{version}" setting.
@@ -208,19 +208,19 @@
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=11 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 11 and selecting it failed"
-  expect_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 
   bazel cquery \
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=local_jdk_11 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 11 and selecting it failed"
-  expect_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 
   bazel cquery \
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=17 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 11 and selecting it failed"
-  expect_not_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_not_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 }
 
 # Bazel shall detect JDK version and configure it with "local_jdk_{version}" and "{version}" setting.
@@ -243,19 +243,19 @@
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=11 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 11 and selecting it failed"
-  expect_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 
   bazel cquery \
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=local_jdk_11 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 11 and selecting it failed"
-  expect_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 
   bazel cquery \
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       --java_runtime_version=17 \
       //java/main:JavaExample &>"${TEST_log}" || fail "Autodetecting a fake JDK version 11 and selecting it failed"
-  expect_not_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_not_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 }
 
 # Failure to detect JDK version shall be handled gracefully.
@@ -278,7 +278,7 @@
       --toolchain_resolution_debug=tools/jdk:runtime_toolchain_type \
       //java/main:JavaExample &>"${TEST_log}" \
       || fail "Failed to resolve Java toolchain when version cannot be detected"
-  expect_log "@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @rules_java~.*~toolchains~local_jdk//:jdk"
+  expect_log "@@bazel_tools//tools/jdk:runtime_toolchain_type -> toolchain @@rules_java~.*~toolchains~local_jdk//:jdk"
 }
 
 # Bazel shall provide Java compilation toolchains that use local JDK.
diff --git a/src/test/shell/bazel/bazel_workspaces_test.sh b/src/test/shell/bazel/bazel_workspaces_test.sh
index 153ce3b..e65a603 100755
--- a/src/test/shell/bazel/bazel_workspaces_test.sh
+++ b/src/test/shell/bazel/bazel_workspaces_test.sh
@@ -148,7 +148,7 @@
 function test_execute2() {
   set_workspace_command 'repository_ctx.execute(["echo", "test_contents"], 21, {"Arg1": "Val1"}, True)'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:25' 1
   ensure_contains_exactly 'arguments: "echo"' 1
@@ -158,13 +158,13 @@
   ensure_contains_exactly 'key: "Arg1"' 1
   ensure_contains_exactly 'value: "Val1"' 1
   # Workspace contains 2 file commands
-  ensure_contains_atleast 'context: "repository @repo"' 3
+  ensure_contains_atleast 'context: "repository @@repo"' 3
 }
 
 function test_execute_quiet2() {
   set_workspace_command 'repository_ctx.execute(["echo", "test2"], 32, {"A1": "V1"}, False)'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:25' 1
   ensure_contains_exactly 'arguments: "echo"' 1
@@ -176,7 +176,7 @@
   ensure_contains_exactly 'key: "A1"' 1
   ensure_contains_exactly 'value: "V1"' 1
   # Workspace contains 2 file commands
-  ensure_contains_atleast 'context: "repository @repo"' 3
+  ensure_contains_atleast 'context: "repository @@repo"' 3
 }
 
 function test_download() {
@@ -192,10 +192,10 @@
 
   set_workspace_command "repository_ctx.download(\"http://localhost:${fileserver_port}/file.txt\", \"file.txt\", \"${file_sha256}\")"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:26' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'download_event' 1
   ensure_contains_exactly "url: \"http://localhost:${fileserver_port}/file.txt\"" 1
   ensure_contains_exactly 'output: "file.txt"' 1
@@ -220,10 +220,10 @@
 
   set_workspace_command "repository_ctx.download([\"http://localhost:${fileserver_port}/file1.txt\",\"http://localhost:${fileserver_port}/file2.txt\"], \"out_for_list.txt\", sha256='${sha256}')"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:26' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'download_event' 1
   ensure_contains_exactly "url: \"http://localhost:${fileserver_port}/file1.txt\"" 1
   ensure_contains_exactly "url: \"http://localhost:${fileserver_port}/file2.txt\"" 1
@@ -247,10 +247,10 @@
 
   set_workspace_command "repository_ctx.download(\"http://localhost:${fileserver_port}/file.txt\", \"file.txt\", integrity=\"${file_integrity}\")"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:26' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'download_event' 1
   ensure_contains_exactly "url: \"http://localhost:${fileserver_port}/file.txt\"" 1
   ensure_contains_exactly 'output: "file.txt"' 1
@@ -276,10 +276,10 @@
 
   set_workspace_command "repository_ctx.download(\"http://localhost:${fileserver_port}/file.txt\", \"file.txt\", integrity=\"${file_integrity}\")"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:26' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'download_event' 1
   ensure_contains_exactly "url: \"http://localhost:${fileserver_port}/file.txt\"" 1
   ensure_contains_exactly 'output: "file.txt"' 1
@@ -336,11 +336,11 @@
   repository_ctx.download(\"http://localhost:${fileserver_port}/download_then_extract.zip\", \"downloaded_file.zip\", \"${file_sha256}\")
   repository_ctx.extract(\"downloaded_file.zip\", \"out_dir\", \"server_dir/\")"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:3:26' 1
   ensure_contains_exactly 'location: .*repos.bzl:4:25' 1
-  ensure_contains_atleast 'context: "repository @repo"' 2
+  ensure_contains_atleast 'context: "repository @@repo"' 2
   ensure_contains_exactly 'download_event' 1
   ensure_contains_exactly "url: \"http://localhost:${fileserver_port}/download_then_extract.zip\"" 1
   ensure_contains_exactly 'output: "downloaded_file.zip"' 1
@@ -373,11 +373,11 @@
   repository_ctx.download(\"http://localhost:${fileserver_port}/download_then_extract.tar.gz\", \"downloaded_file.tar.gz\", \"${file_sha256}\")
   repository_ctx.extract(\"downloaded_file.tar.gz\", \"out_dir\", \"data_dir/\")"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:3:26' 1
   ensure_contains_exactly 'location: .*repos.bzl:4:25' 1
-  ensure_contains_atleast 'context: "repository @repo"' 2
+  ensure_contains_atleast 'context: "repository @@repo"' 2
   ensure_contains_exactly 'download_event' 1
   ensure_contains_exactly "url: \"http://localhost:${fileserver_port}/download_then_extract.tar.gz\"" 1
   ensure_contains_exactly 'output: "downloaded_file.tar.gz"' 1
@@ -407,10 +407,10 @@
 
   set_workspace_command "repository_ctx.download_and_extract(\"http://localhost:${fileserver_port}/download_and_extract.zip\", \"out_dir\", \"${file_sha256}\", \"zip\", \"server_dir/\")"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:38' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'download_and_extract_event' 1
   ensure_contains_exactly "url: \"http://localhost:${fileserver_port}/download_and_extract.zip\"" 1
   ensure_contains_exactly 'output: "out_dir"' 1
@@ -440,10 +440,10 @@
     'prefix/A.txt': 'prefix/renamed-A.txt',
   })"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:3:25' 1
-  ensure_contains_atleast 'context: "repository @repo"' 2
+  ensure_contains_atleast 'context: "repository @@repo"' 2
   ensure_contains_exactly 'extract_event' 1
   ensure_contains_exactly 'rename_files' 1
   ensure_contains_exactly 'key: "prefix/A.txt"' 1
@@ -468,10 +468,10 @@
   set_workspace_command "
   repository_ctx.extract('${archive_tar}', 'out_dir', 'Ä_pax_∅/')"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:3:25' 1
-  ensure_contains_atleast 'context: "repository @repo"' 2
+  ensure_contains_atleast 'context: "repository @@repo"' 2
   ensure_contains_exactly 'extract_event' 1
 
   ensure_output_contains_exactly_once "external/repo/out_dir/Ä_foo_∅.txt" "bar"
@@ -491,10 +491,10 @@
   set_workspace_command "
   repository_ctx.extract('${archive_tar}', 'out_dir', 'Ä_ustar_∅/')"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:3:25' 1
-  ensure_contains_atleast 'context: "repository @repo"' 2
+  ensure_contains_atleast 'context: "repository @@repo"' 2
   ensure_contains_exactly 'extract_event' 1
 
   ensure_output_contains_exactly_once "external/repo/out_dir/Ä_foo_∅.txt" "bar"
@@ -519,10 +519,10 @@
   set_workspace_command "
   repository_ctx.extract('${archive_tar}', 'out_dir', 'Ä_ustar_latin1_∅/')"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:3:25' 1
-  ensure_contains_atleast 'context: "repository @repo"' 2
+  ensure_contains_atleast 'context: "repository @@repo"' 2
   ensure_contains_exactly 'extract_event' 1
 
   ensure_output_contains_exactly_once "$(echo -e 'external/repo/out_dir/\xC4_foo_latin1_\xD6.txt')" "bar"
@@ -540,10 +540,10 @@
   set_workspace_command "
   repository_ctx.extract('${archive_tar}', 'out_dir', 'Ä_default_∅/')"
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:3:25' 1
-  ensure_contains_atleast 'context: "repository @repo"' 2
+  ensure_contains_atleast 'context: "repository @@repo"' 2
   ensure_contains_exactly 'extract_event' 1
 
   ensure_output_contains_exactly_once "external/repo/out_dir/Ä_foo_∅.txt" "bar"
@@ -552,10 +552,10 @@
 function test_file() {
   set_workspace_command 'repository_ctx.file("filefile.sh", "echo filefile", True)'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:22' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
 
   # There are 3 file_event in external:repo as it is currently set up
   ensure_contains_exactly 'file_event' 3
@@ -567,10 +567,10 @@
 function test_file_nonascii() {
   set_workspace_command 'repository_ctx.file("filefile.sh", "echo fïlëfïlë", True)'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:22' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
 
   # There are 3 file_event in external:repo as it is currently set up
   ensure_contains_exactly 'file_event' 3
@@ -598,11 +598,11 @@
   if read_result != content:
     fail("read(): expected %r, got %r" % (content, read_result))'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:4:22' 1
   ensure_contains_exactly 'location: .*repos.bzl:5:36' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
 
   ensure_contains_exactly 'read_event' 1
   ensure_contains_exactly 'path: ".*filefile.sh"' 2
@@ -619,7 +619,7 @@
   if read_result != corrupted_content:
     fail("read(): expected %r, got %r" % (corrupted_content, read_result))'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 }
 
 function test_read_roundtrip_nolegacy_utf8() {
@@ -630,15 +630,15 @@
   if read_result != content:
     fail("read(): expected %r, got %r" % (content, read_result))'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 }
 
 function test_os() {
   set_workspace_command 'print(repository_ctx.os.name)'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'os_event' 1
 }
 
@@ -646,10 +646,10 @@
   set_workspace_command 'repository_ctx.file("symlink.txt", "something")
   repository_ctx.symlink("symlink.txt", "symlink_out.txt")'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:22' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'symlink_event' 1
   ensure_contains_exactly 'target: ".*symlink.txt"' 1
   ensure_contains_exactly 'path: ".*symlink_out.txt"' 1
@@ -659,10 +659,10 @@
   set_workspace_command 'repository_ctx.file("template_in.txt", "%{subKey}", False)
   repository_ctx.template("template_out.txt", "template_in.txt", {"subKey": "subVal"}, True)'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:22' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'template_event' 1
   ensure_contains_exactly 'path: ".*template_out.txt"' 1
   ensure_contains_exactly 'template: ".*template_in.txt"' 1
@@ -674,10 +674,10 @@
 function test_which() {
   set_workspace_command 'print(repository_ctx.which("which_prog"))'
 
-  build_and_process_log --exclude_rule "repository @local_config_cc"
+  build_and_process_log --exclude_rule "repository @@local_config_cc"
 
   ensure_contains_exactly 'location: .*repos.bzl:2:29' 1
-  ensure_contains_atleast 'context: "repository @repo"' 1
+  ensure_contains_atleast 'context: "repository @@repo"' 1
   ensure_contains_exactly 'which_event' 1
   ensure_contains_exactly 'program: "which_prog"' 1
 }
diff --git a/src/test/shell/bazel/check_external_files_test.sh b/src/test/shell/bazel/check_external_files_test.sh
index a56d055..0751c05 100755
--- a/src/test/shell/bazel/check_external_files_test.sh
+++ b/src/test/shell/bazel/check_external_files_test.sh
@@ -120,7 +120,7 @@
   bazel build --noexperimental_check_external_repository_files @remote//:g >& "$TEST_log" || fail "Expected build to succeed"
 
   bazel build @remote//:g >& "$TEST_log" && fail "Expected build to fail" || true
-  expect_log "no such target '@remote//:g'"
+  expect_log "no such target '@@remote//:g'"
 }
 
 test_check_all_flags_fast() {
@@ -157,7 +157,7 @@
     $extra_args \
     @local_rep//:g >& "$TEST_log" && fail "Expected build to fail" || true
   bazel build --noexperimental_check_external_repository_files @local_rep//:g >& "$TEST_log" && fail "Expected build to fail" || true
-  expect_log "no such target '@local_rep//:g'"
+  expect_log "no such target '@@local_rep//:g'"
 }
 
 test_local_repository_isnt_affected() {
@@ -175,7 +175,7 @@
   setup_local
   create_workspace_with_default_repos WORKSPACE
   bazel build @local_rep//:g >& "$TEST_log" && fail "Expected build to fail" || true
-  expect_log "no such package '@local_rep//'"
+  expect_log "no such package '@@local_rep//'"
 
   argv="--override_repository=local_rep=$(pwd)/../local_rep"
   bazel build "$argv" $extra_args @local_rep//:g >& "$TEST_log" || fail "Expected build to succeed"
@@ -187,7 +187,7 @@
     "$argv" \
     $extra_args \
     @local_rep//:g >& "$TEST_log" && fail "Expected build to fail" || true
-  expect_log "no such target '@local_rep//:g'"
+  expect_log "no such target '@@local_rep//:g'"
 }
 
 test_override_repository_isnt_affected() {
@@ -205,7 +205,7 @@
     --noexperimental_check_output_files \
     --watchfs \
     @remote//:g >& "$TEST_log" && fail "Expected build to fail" || true
-  expect_log "no such package '@bazel_tools//tools/build_defs/repo'"
+  expect_log "no such package '@@bazel_tools//tools/build_defs/repo'"
   bazel build \
     --fetch \
     --noexperimental_check_external_repository_files \
diff --git a/src/test/shell/bazel/cross_repository_test.sh b/src/test/shell/bazel/cross_repository_test.sh
index c742dc1..1ab3e7f 100755
--- a/src/test/shell/bazel/cross_repository_test.sh
+++ b/src/test/shell/bazel/cross_repository_test.sh
@@ -72,9 +72,9 @@
   # These should fail, they is using the wrong label that crosses the
   # repository boundary.
   bazel build //:depend_directly >& $TEST_log && fail "build should fail"
-  expect_log "no such package 'bar': Invalid package reference bar crosses into repository @bar"
+  expect_log "no such package 'bar': Invalid package reference bar crosses into repository @@bar"
   bazel build //:depend_directly_subdir >& $TEST_log && fail "build should fail"
-  expect_log "no such package 'bar/subbar': Invalid package reference bar/subbar crosses into repository @bar"
+  expect_log "no such package 'bar/subbar': Invalid package reference bar/subbar crosses into repository @@bar"
 }
 
 function test_top_level_local_repository {
@@ -121,7 +121,7 @@
   # This should fail, it is using the wrong label that crosses the repository
   # boundary.
   bazel build //:depend_directly >& $TEST_log && fail "build should fail"
-  expect_log "no such package 'bar': Invalid package reference bar crosses into repository @bar"
+  expect_log "no such package 'bar': Invalid package reference bar crosses into repository @@bar"
 }
 
 # Load rules via an invalid label.
@@ -188,9 +188,9 @@
 
   # These should now fail, using the incorrect label.
   bazel query //bar:bar >& $TEST_log && fail "build should fail"
-  expect_log "no such package 'bar': Invalid package reference bar crosses into repository @bar"
+  expect_log "no such package 'bar': Invalid package reference bar crosses into repository @@bar"
   bazel query //bar/subbar:subbar >& $TEST_log && fail "build should fail"
-  expect_log "no such package 'bar/subbar': Invalid package reference bar/subbar crosses into repository @bar"
+  expect_log "no such package 'bar/subbar': Invalid package reference bar/subbar crosses into repository @@bar"
 
   # These should succeed.
   echo "about to test @bar//"
diff --git a/src/test/shell/bazel/external_correctness_test.sh b/src/test/shell/bazel/external_correctness_test.sh
index 77af6b3..b09e052 100755
--- a/src/test/shell/bazel/external_correctness_test.sh
+++ b/src/test/shell/bazel/external_correctness_test.sh
@@ -163,11 +163,11 @@
   echo "local_repository(name='r', path='$REMOTE')" > WORKSPACE
   bazel build @r//v:rv >& $TEST_log || fail "Build failed"
   bazel build @r//a:ra >& $TEST_log && fail "Build succeeded"
-  expect_log "target '@r//:fg' is not visible"
+  expect_log "target '@@r//:fg' is not visible"
   bazel build //a:ma >& $TEST_log && fail "Build succeeded"
-  expect_log "target '@r//:fg' is not visible"
+  expect_log "target '@@r//:fg' is not visible"
   bazel build //v:mv >& $TEST_log && fail "Build succeeded"
-  expect_log "target '@r//:fg' is not visible"
+  expect_log "target '@@r//:fg' is not visible"
 
 }
 
@@ -235,7 +235,7 @@
 
   bazel build @r//:fg || fail "Build failed"
   bazel build //:fg >& $TEST_log && fail "Build succeeded"
-  expect_log "target '@r//r:fg1' is not visible"
+  expect_log "target '@@r//r:fg1' is not visible"
 
 }
 
diff --git a/src/test/shell/bazel/local_repository_test.sh b/src/test/shell/bazel/local_repository_test.sh
index ea32f83..aef690e 100755
--- a/src/test/shell/bazel/local_repository_test.sh
+++ b/src/test/shell/bazel/local_repository_test.sh
@@ -1372,7 +1372,7 @@
 
   bazel build @x_repo//a >& $TEST_log && fail "Building @x_repo//a should error out"
   expect_log "** Please add the following dependencies:"
-  expect_log "@x_repo//x to @x_repo//a"
+  expect_log "@@x_repo//x to @@x_repo//a"
 }
 
 # This test verifies that the `public` pattern includes external dependencies.
diff --git a/src/test/shell/bazel/starlark_repository_test.sh b/src/test/shell/bazel/starlark_repository_test.sh
index 9c7fc50..4a4fe82 100755
--- a/src/test/shell/bazel/starlark_repository_test.sh
+++ b/src/test/shell/bazel/starlark_repository_test.sh
@@ -295,7 +295,7 @@
   [ $exitCode != 0 ] || fail "building @foo//:data.txt succeed while expected failure"
 
   expect_not_log "PACKAGE"
-  expect_log "Failed to load Starlark extension '@foo//:ext.bzl'"
+  expect_log "Failed to load Starlark extension '@@foo//:ext.bzl'"
 }
 
 function test_load_nonexistent_with_subworkspace() {
@@ -313,7 +313,7 @@
   [ $exitCode != 0 ] || fail "building //... succeed while expected failure"
 
   expect_not_log "PACKAGE"
-  expect_log "Failed to load Starlark extension '@does_not_exist//:random.bzl'"
+  expect_log "Failed to load Starlark extension '@@does_not_exist//:random.bzl'"
 
   # Retest with query //...
   bazel clean --expunge
@@ -321,7 +321,7 @@
   [ $exitCode != 0 ] || fail "querying //... succeed while expected failure"
 
   expect_not_log "PACKAGE"
-  expect_log "Failed to load Starlark extension '@does_not_exist//:random.bzl'"
+  expect_log "Failed to load Starlark extension '@@does_not_exist//:random.bzl'"
 }
 
 function test_starlark_local_repository() {
diff --git a/src/test/shell/bazel/workspace_resolved_test.sh b/src/test/shell/bazel/workspace_resolved_test.sh
index 50d43e6..f3abd91 100755
--- a/src/test/shell/bazel/workspace_resolved_test.sh
+++ b/src/test/shell/bazel/workspace_resolved_test.sh
@@ -512,7 +512,7 @@
 broken_rule(name = "broken")
 EOF
   bazel sync --curses=yes --experimental_ui_actions_shown=100 > "${TEST_log}" 2>&1 && fail "expected failure" || :
-  expect_log 'Fetching repository @broken'
+  expect_log 'Fetching repository @@broken'
   expect_log "DEBUG-message"
   expect_log "Failure-message"
 }
diff --git a/src/test/shell/bazel/workspace_test.sh b/src/test/shell/bazel/workspace_test.sh
index a2b8cbe..7a80741 100755
--- a/src/test/shell/bazel/workspace_test.sh
+++ b/src/test/shell/bazel/workspace_test.sh
@@ -419,7 +419,7 @@
 
   bazel query --experimental_ui_debug_all_events \
         @flower//daisy:all >& "$TEST_log" || fail "Expected success"
-  expect_log "Loading package: @flower//daisy"
+  expect_log "Loading package: @@flower//daisy"
   expect_log "@flower//daisy:daisy"
 
   # Change mapping in tree/WORKSPACE
@@ -441,7 +441,7 @@
   # Test that packages in the flower workspace are reloaded
   bazel query --experimental_ui_debug_all_events \
         @flower//daisy:all >& "$TEST_log" || fail "Expected success"
-  expect_log "Loading package: @flower//daisy"
+  expect_log "Loading package: @@flower//daisy"
   expect_log "@flower//daisy:daisy"
 }
 
diff --git a/src/test/shell/integration/target_compatible_with_test.sh b/src/test/shell/integration/target_compatible_with_test.sh
index 619ba70..821c03f 100755
--- a/src/test/shell/integration/target_compatible_with_test.sh
+++ b/src/test/shell/integration/target_compatible_with_test.sh
@@ -1013,7 +1013,7 @@
     && fail "Bazel passed unexpectedly."
 
   expect_log 'ERROR:.* Target //target_skipping:pass_on_foo3_and_bar2 is incompatible and cannot be built, but was explicitly requested'
-  expect_log "^    //target_skipping:pass_on_foo3_and_bar2 (.*)   <-- target platform (//target_skipping:foo1_bar1_platform) didn't satisfy constraint @platforms//:incompatible$"
+  expect_log "^    //target_skipping:pass_on_foo3_and_bar2 (.*)   <-- target platform (//target_skipping:foo1_bar1_platform) didn't satisfy constraint @\?@platforms//:incompatible$"
   expect_log 'ERROR: Build did NOT complete successfully'
 }
 
diff --git a/src/test/shell/integration/target_compatible_with_test_external_repo.sh b/src/test/shell/integration/target_compatible_with_test_external_repo.sh
index 38f32f8..1010f2f 100755
--- a/src/test/shell/integration/target_compatible_with_test_external_repo.sh
+++ b/src/test/shell/integration/target_compatible_with_test_external_repo.sh
@@ -204,12 +204,12 @@
     --platforms=@//:foo3_platform \
     --build_event_text_file="${TEST_log}".build.json \
     @test_repo//:bin &> "${TEST_log}" && fail "Bazel passed unexpectedly."
-  expect_log 'ERROR:.*Target @test_repo//:bin is incompatible and cannot be built'
+  expect_log 'ERROR:.*Target @@test_repo//:bin is incompatible and cannot be built'
   expect_log '^ERROR: Build did NOT complete successfully'
   # Now look at the build event log.
   mv "${TEST_log}".build.json "${TEST_log}"
   expect_log '^    name: "PARSING_FAILURE"$'
-  expect_log 'Target @test_repo//:bin is incompatible and cannot be built.'
+  expect_log 'Target @@test_repo//:bin is incompatible and cannot be built.'
 }
 
 # Regression test for https://github.com/bazelbuild/bazel/issues/12374
diff --git a/src/test/shell/integration/toolchain_test.sh b/src/test/shell/integration/toolchain_test.sh
index fa15c4a..39d3f4d 100755
--- a/src/test/shell/integration/toolchain_test.sh
+++ b/src/test/shell/integration/toolchain_test.sh
@@ -2631,7 +2631,7 @@
   # Test the build.
   bazel build \
     "//${pkg}/demo:demo" &> $TEST_log || fail "Build failed"
-  expect_log "foo_tool = <target @rules_foo//foo_tools:foo_tool>"
+  expect_log "foo_tool = <target @@rules_foo//foo_tools:foo_tool>"
 }
 
 function test_exec_platform_order_with_mandatory_toolchains {
diff --git a/src/test/shell/testenv.sh.tmpl b/src/test/shell/testenv.sh.tmpl
index 94b459c..80d15b6 100755
--- a/src/test/shell/testenv.sh.tmpl
+++ b/src/test/shell/testenv.sh.tmpl
@@ -99,7 +99,7 @@
 tools_dir="$(dirname $(rlocation io_bazel/tools/BUILD))"
 
 # Platforms
-default_host_platform="@local_config_platform//:host"
+default_host_platform="@@local_config_platform//:host"
 
 # Sandbox tools
 process_wrapper="${BAZEL_RUNFILES}/src/main/tools/process-wrapper"