Read and write are SEPARATE capabilities — declare only what you use. A "copy" button needs just clipboardWrite; clipboardRead is more sensitive (it sees whatever the user last copied, which could be a password), so request it only if you genuinely need paste in.
// app.json: { "capabilities": ["clipboardRead", "clipboardWrite"] }
const wrote = await window.chatoss.clipboard.writeText('Copied from my app!'); // resolves true
const text = await window.chatoss.clipboard.readText(); // resolves the clipboard text
Clipboard is a low-friction convenience, so it does NOT prompt. The user can still turn either capability off any time from the app's Permissions panel (the ⋯ menu → Settings on its row in the Apps manager); a turned-off call rejects, so wrap clipboard calls in try/catch.