pnpm setup-env creates .env from .env.example and fills in fresh OAUTH_PRIVATE_KEYS and SECRET_KEY, so local setup is one step instead of copying secrets by hand. It is pnpm keys --write, which never replaces a secret already set, since a new SECRET_KEY can't decrypt stored API keys; plain pnpm keys still prints a pair.