Interesting question. It is colloquial (slang) usage, and I think originally American. Often slang usage is difficult to understand and may not seem to make much sense. Note that it can be used with other positive adjectives, eg 'tough cookie', for a tough, self-resilient, or 'hard' person. From the Oxford English Dictionary: Usually with modifying adjective expressing some positive personal quality: a person. Esp. in smart cookie, tough cookie. 1928 Chicago Tribune 7 Oct. (Comics) 2 What a swell bunch of cookies you turned out to be. 1939 Oakland (Calif.) Tribune 4 June a9/1 We're a couple of smart cookies, hey? 1942 Amer. Mercury Oct. 436/1 Just about the toughest cookie ever born. 1953 W. R. Burnett Vanity Row xvi. 110 He's a real tough cookie and you know it. 1981 W. Gleason Perils of Lulu ii. 40 You're one smart cookie. That deserves a kiss. 2009 Mirror (Nexis) 24 Mar. 3 [She] is a smart cookie and..won't rush into making any rash decisions. The Oxford English Dictionary says that cookie (as in biscuit) is from the Dutch ("probably < Dutch koekje /ˈkuːkjə/ diminutive of koek cake: this is apparently certain for U.S.; but for Scotland historical evidence has not been found").

It is not a new expression, according to Ngram it has been used from the '40s. One of the few references available says: (hardly a compliment I'd say) The meaning is clear, perhaps, but tracing the origin is challenging. Tough cookies are almost as common as sharp and smart cookies, suggesting the key to the etymology lies in tracing the usage of 'cookie' referring to a person. OED chases it back to the 1920's in the US, and suggests that it associated with both women (1920 Colliers Magazine: That girlfriend of yours is a cookie) and men (1942 American Mercury Magazine: Just about the toughest cookie ever born.)