What they did
The poster's NordicTrack Commercial 2250 has a large screen that is really an Android 9 tablet running iFit, which gates streaming apps and most features behind a monthly subscription. They connected Claude Code to the console over ADB and kept a CLAUDE.md file as the project's running memory. Claude explored the device, found that iFit's motor service exposes a local gRPC port, studied how the open source qdomyos-zwift (QZ) project talks to it, and wrote a new client in plain Java. It then built a launcher app with tiles for the streaming services, a floating bar showing speed, incline, time and distance, a lap and pace panel, and on-screen controls. iFit apps were disabled one at a time with a motor health check after each, and the iFit lockdown and updater app was removed for the main user in a reversible way.
How it went
It worked after about a day and a half. The treadmill now boots unlocked into the poster's own home screen with no login, ads or nags, and Netflix opens in about 21 seconds instead of close to a minute. Not every step went cleanly: disabling one app killed the motor service, and another mistake took half an hour to reverse. Each lesson went into CLAUDE.md so later sessions avoided it. Netflix only plays in SD, the tablet is still slow, and a factory reset would wipe the setup.
Worth knowing
Claude refused to reverse engineer the motor board's security handshake, so the app still goes through iFit's own motor service, which also keeps the safety key in charge. It also balked at starting the belt remotely until the poster confirmed nobody was near it; every remote test then ran with a speed cap, a stop that fires even if the script fails, and a final zero-speed check. The code is public on GitHub.